DHS Leak Puts 41,000 Names and 55,000 Access-Group Labels Online, and Nobody Agrees Where the Data Came From

A directory of more than 41,000 Department of Homeland Security employees and contractors is now searchable online, including work contact details, office locations and access-group names that point to undercover and surveillance programs. Distributed Denial of Secrets published it as an archive called Icepick on October 28, and DHS has said only that it is aware of a "potential breach."

Wired first reported the leak. Wired's page could not be fetched for this report, so the details below come from Engadget's account of it, published October 29 and credited to Mariella Moon, and from an MLQ.ai summary of the same reporting.

What the archive contains

The records cover DHS headquarters and seven component agencies, and Engadget cites Wired's estimate that they represent about a seventh of the department's workforce. The data classes are names, email addresses, phone numbers, office addresses, job titles and supervisors, plus more than 55,000 permission-group names, per MLQ.ai. No passwords or case files are mentioned in either account.

Component	Records
Customs and Border Protection	About 21,000
Immigration and Customs Enforcement	About 10,000
US Citizenship and Immigration Services	About 6,200 (MLQ.ai)
Cybersecurity and Infrastructure Security Agency	Nearly 1,000 (MLQ.ai)

The permission-group names carry the sensitive part. Engadget says some point to wiretap, undercover and surveillance work. MLQ.ai notes that the labels reference AI tools and Palantir and PenLink products, and adds that a group name alone does not prove a tool was used or a system accessed.

CISA staff are among those listed. CISA is the agency that issued the three-day PHP2Shell order.

Who says what about the source

Engadget says a group calling itself the "Department of Peace" took the records and passed them to Distributed Denial of Secrets and to the Swiss researcher maia arson crimew. Emma Best, the nonprofit's founder, said the files link officials overseeing covert operations to staff in DHS's removal programs, per Engadget.

The group's reason, in Engadget's account, was a July 17 remark by DHS Secretary Markwayne Mullin that the department was "turning up the heat on the streets." The group wrote: "They have our information, so it's only fair that we have theirs."

On the mechanism, the accounts diverge. Engadget says the group "apparently" took the data through Okta, the single sign-on service DHS uses. MLQ.ai says DDoSecrets itself attributes the data to DHS's Okta login system. Okta told Wired it has found no evidence that its "data or systems were compromised."

Neither account identifies a DHS tenant, an account or an access path. A leaked directory fits a stolen export, a compromised administrator account or an abused integration equally well, and none of the sources distinguishes among them.

What DHS has and has not said

A DHS spokesperson said the department is "aware of a potential breach and is actively working to address the situation swiftly and effectively." MLQ.ai reports that DHS has not said how the data was obtained, whether every record is authentic, how many people it contacted, or whether it rotated credentials or restricted access.

There is a precedent in the same year. MLQ.ai notes that a January 2026 allegation involving about 4,500 ICE and Border Patrol employees was never confirmed by DHS.

Recorded Future's Alexander Leslie said the data would be useful for targeting DHS staff if it proves authentic and current, per MLQ.ai.

No notification count or date has been published. Brotli's fix, by comparison, sat public for eight months before an advisory.