An archive containing records of more than 41,000 Department of Homeland Security employees and contractors became public on Wednesday. It includes names, work addresses, phone numbers, email addresses, office locations and descriptions of what each person does — among them thousands of staff at Immigration and Customs Enforcement and Customs and Border Protection, the agencies that have carried out raids across the United States.
The database, named "Icepick," was published by a group calling itself the Department of Peace together with security researcher maia arson crimew, and hosted by the nonprofit Distributed Denial of Secrets. According to DDoSecrets, the point was not a directory of every DHS officer but to replace anonymity with accountability: it names, co-founder Emma Best said, the officials responsible for overseeing covert and undercover operations, for the hunt for leakers, for the failed BlueLeaks investigation, and key personnel in DHS's deportation programs.
The more consequential half of the leak
Beyond personal data, the archive maps DHS units to surveillance tools, including the facial recognition app Mobile Fortify and PenLink, software for analyzing phone and online records. That mapping is the strategically sensitive part: it says not only who works at DHS, but which teams can reach which capabilities.
The department has spent months shielding the identities of CBP and ICE personnel — many now appear masked and without name tags on operations, citing fear of harassment — while also tracking down online critics. "They have our information, so it's only fair that we have theirs," the person behind the Department of Peace told TechCrunch.
How the data got out
The group says it reached the profiles through Okta, the single sign-on service. Okta rejected the account: it is aware of the claims, a spokeswoman said, but "Okta is secure, and we have no evidence our data or systems were compromised." How the data actually left is therefore unresolved — a hijacked account, a customer-side misconfiguration and a compromised supplier would all be consistent with that statement.
It is the third agency incident in weeks. In September the FBI was hit, with the group ShinyHunters taking personal information on thousands of agents and applicants. Days later the Federal Election Commission went offline after a suspected attack. Three agencies, three different attack surfaces — and a pattern that looks less like one campaign than like a broad hunt for weak identity infrastructure.
What needs answering
DHS did not immediately respond to requests for comment. The questions that matter in any breach of this kind remain open: how old the records are, how complete, and whether the people in them have been told. For the staff involved that is practical, not abstract — the work addresses and phone numbers of border agents are a physical safety risk in the US, not merely a privacy incident.
For everyone else the lesson is less comfortable. A single sign-on system is a convenient place to break in precisely because it does what it promises: it connects hundreds of applications to one identity. Whoever stands there stands everywhere. That is why whether Okta was compromised or a customer was is not a public-relations argument — it decides how many of those 41,000 records are still to come.
