DHS Employee Data Leak Exposes 41,000 Records

A significant data breach has exposed the professional and personal details of more than 41,000 individuals working for the Department of Homeland Security and its constituent agencies. The leaked records, last updated on August 19, 2026, include email addresses, phone numbers, office addresses, and references to internal systems. The dataset also contains sensitive information regarding undercover and surveillance programs. According to an analysis, Customs and Border Protection staffers account for more than half of the leaked records. Immigration and Customs Enforcement accounts for about 10,000 records, with roughly a third belonging to Homeland Security Investigations. Nearly 6,200 records belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency.

The transparency nonprofit Distributed Denial of Secrets, known as DDoSecrets, published the archive on Wednesday. The dataset, dubbed Icepick, was previewed for WIRED by DDoSecrets and cybersecurity researcher maia arson crimew. DDoSecrets states that the data originates from the Department of Homeland Security's Okta login system. A note accompanying the files stated that the hackers believed it was fair to possess the information because the government had their data. TechCrunch reported on Wednesday that a hacker obtained over 40,000 user account records from the login system. The searchable website hosting the data no longer loads as of Thursday morning due to a server hold placed by the domain registrar.

The leak follows a period where the Department of Homeland Security aggressively pursued critics and sought to unmask anonymous social media users. The agency expanded its definition of doxing to include basic facts about public employees. This incident also follows a previous breach where hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. In response to the current leak, Homeland Security filed a takedown notice via security vendor ZeroFox. The notice asked the domain registrar to stop serving personal contact and location data of individuals who did not consent to its publication.

An Okta spokesperson told WIRED that the company is unaware of any breach and has no evidence its data or systems were compromised. A Homeland Security spokesperson stated that the department is aware of a potential breach and is actively working to address the situation. Bluesky blocked links to the nonprofit website hosting the leaked dataset, marking them as malicious. Bluesky chief operating officer Rose Wang stated that the company is blocking the links because the dataset includes email addresses and phone numbers shared without authorization.