A leaked slice of the US Department of Homeland Security's Okta single sign-on system has been published online, exposing the names, work contact details and — more revealing — the internal permission groups of more than 41,000 employees and contractors, including undercover investigators, deportation officers and staff tied to wiretap and surveillance programmes.
The transparency group Distributed Denial of Secrets (DDoSecrets) and security researcher and journalist maia arson crimew previewed the archive to WIRED and published it on Wednesday under the name "Icepick". The records span DHS itself and seven component agencies — Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Citizenship and Immigration Services (USCIS), CISA, the Federal Protective Service and others — and carry timestamps up to 19 August 2026. A group calling itself the Department of Peace told the outlets it took the data from DHS's Okta login system. In a note left with the files, the hackers wrote: "They have our information, so it's only fair that we have theirs."
Okta denies being breached. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," a spokesperson said. How the data left the identity provider is therefore unresolved: a misconfigured integration, a compromised account with read access, or an exfiltration path through a downstream application that federates to Okta are all still on the table.
The breakdown is a map of the agency. CBP accounts for more than half the dataset — around 21,000 records, per TechCrunch — with roughly 10,000 for ICE, about a third of those in Homeland Security Investigations (HSI). USCIS contributes about 6,200 and CISA close to 1,000, more than half of them contractors. Altogether the files cover roughly a fifth of DHS's 220,000 staff.
What makes this leak different from a directory dump is the group membership. At HSI, 39 employees across more than a dozen field offices sit in groups whose names include "CUC" — which federal court filings describe as "certified undercover operation". Another group, apparently based in HSI's St. Paul, Minnesota area of operations, references "Keyhole", described in court filings as a certified undercover operation that recently funded HSI's undercover surveillance of Minneapolis protest groups. Others name a "Communications Intercept Center TechOps (CICTO) Program", a "Title III Intercept Program" for wiretaps and an "Illicit Sensor Intercept Program (ISIP)". The archive lists more than 55,000 such groups in total.
The group names also disclose the vendor stack. They reference Palantir's Falcon investigative platform and PenLink, which analyses phone records, location data and social media. More than 700 accounts belong to a group apparently tied to Signal, nearly all CBP. Around 200 CBP accounts sit in a Mobile Fortify group — the facial recognition app agents use to identify people — including field supervisors, special response team operators and tactical and intelligence agents, about half of them in Texas, California and Arizona. Two groups called "Executive Leadership" and "AI Access" contain the same 13 people holding exceptions to the department's web filter, including former secretary Kristi Noem, recently departed CIO Antoine McCord (now back at Anduril), Philip Hegseth as a senior adviser to the secretary, and policy adviser Jayce Krachenfels. Other groups reference ChatGPT, Google Gemini, Microsoft Copilot and Grok.com.
The data also captures the speed of the enforcement build-out: about 1,300 ICE enforcement accounts were created after 4 July 2025, the day President Trump signed the One Big Beautiful Bill Act funding 10,000 additional Enforcement and Removal officers.
Security specialists describe the archive as an intelligence problem rather than a privacy one. "If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," said Alexander Leslie of Recorded Future. "This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations."
It is also the latest in a series. Earlier this year the ShinyHunters group claimed to have stolen personal data on nearly every FBI employee and their families, with arrests following. It is the second DHS breach this year: the same actor says it already took thousands of department contracts with defence contractors and surveillance vendors. DHS and the Justice Department did not respond to requests for comment.
The political context sharpens the stakes. DHS has spent the year pursuing its critics — seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters — while moving to hide employees' names and faces and widening its definition of "doxing" to cover publication of names and job titles. Adam Steinbaugh, a senior attorney at FIRE, called that untenable: "This is information that would be on a business card. That's not something the government can criminalize." The leakers make the same argument from the other direction. "If they weren't hiding their involvement in the repressive arm of the US government there would be no need for us to expose them in the first place," crimew said.
