Leak Exposes 41,000 Homeland Security Workers, Including Undercover ICE Agents

The phone numbers and office addresses are the least of it. Among the records of more than 41,000 Department of Homeland Security employees and contractors published this week are access-group names that tie 39 Homeland Security Investigations staff, spread across more than a dozen field offices, to “certified undercover operations.” For a department that has spent the past year trying to keep its officers' names out of public view, that is the worst kind of exposure: not who works there, but who is working undercover.

The archive, which the transparency nonprofit Distributed Denial of Secrets calls “Icepick,” covers DHS itself and seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection. The records were last updated on August 19, 2026. DDoSecrets and the cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, saying they obtained it from a group calling itself the Department of Peace.

What makes the files more than a phone book is structure. Each person is listed with the permission groups they belong to, and there are more than 55,000 of those groups. Their names describe wiretap programmes, phone-extraction tools, AI services and a short list of senior officials allowed around the department's web filter. Read together, the leak is a working map of how DHS is organised and what its people can reach.

What the Icepick files contain

For each person, the records include an email address, a phone number and an office address. That is roughly what any corporate directory holds, and it is the part most useful to someone who wants to contact, impersonate or harass an individual officer. On its own it would be an embarrassing security lapse. Combined with everything else in the archive, it becomes something closer to an org chart with a contact sheet stapled to it.

The rest is organisational. Nearly everyone named belongs to at least some permission groups, the ordinary mechanism large organisations use to decide who can open which internal system. Because group names tend to describe what they unlock, a membership list doubles as an inventory of DHS's internal systems and programmes, from tools for immigration court records to surveillance software. The files also carry references to undercover and surveillance programmes that DHS would never publish itself.

The hackers left a one-line rationale in a note with the files: “They have our information, so it's only fair that we have theirs.” crimew has built a searchable website over the data. “I don't think we should let them scare us into not looking into them,” she told WIRED.

Who is in it, agency by agency

WIRED's analysis of the data breaks the records down by agency. Customs and Border Protection staff make up more than half. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE's investigative wing. US Citizenship and Immigration Services contributes another 6,200, and nearly 1,000 records belong to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors.

The span runs from senior leadership down to individual immigration agents and detention contractors. That vertical reach is what makes the files useful for mapping. An analyst can see not just who holds a title, but which office they sit in and which systems their account touches, and can follow the chain of command from the top of the department to a single field office.

The CISA slice has its own sting. An agency whose name begins with cybersecurity now has its staff and contractors' details sitting in the same public archive as everyone else's, and its contractor-heavy profile shows how much of the department's work is done by people who are not federal employees at all.

Undercover and intercept programmes in plain sight

The group names most likely to worry DHS sit inside HSI. Thirty-nine employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for certified undercover operation. A membership list does not reveal what an officer does undercover, or under what identity. It does shrink a very large haystack to 39 names, each with an office location and a phone number attached.

One group, apparently based in HSI's St. Paul, Minnesota, area of operations, references “Keyhole.” Federal court filings describe Keyhole as a certified undercover operation that funded HSI's undercover surveillance of Minneapolis protest groups earlier this year. That gives the leak a direct line to one of the most contested uses of the department's investigative powers, and to the specific people provisioned for it.

Other groups name intercept work outright: a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).” Programme names like these are rarely public, and seeing them alongside membership lists tells an outsider not only that the capabilities exist, but roughly how many people and which offices they involve.

55,000 groups, read as a tool inventory

Across the full set of more than 55,000 permission groups, names appear to reference tools for accessing immigration court records, pulling data from seized phones and conducting surveillance. Two commercial products are named: Palantir's Falcon investigative platform and PenLink, which analyses phone records and social media. Neither name says how often the tools are used or against whom, but both confirm what is in the toolkit.

AI services show up too. Groups reference OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. One, called “Grok.com,” includes eight DHS technology officials, among them the department's former chief information officer and chief data officer. For anyone tracking how federal agencies are adopting generative AI, a permission list is harder evidence than a policy memo: it records who was actually given access.

For an attacker, the inventory answers a different question. It shows whose account opens which door, which is the first thing anyone planning a targeted phishing campaign would want to know. That is the logic behind the warning from Recorded Future quoted in the final section.

Thirteen names on the web-filter exception list

Two groups, “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS's web filter, which blocks some websites for employees. Both contain the same 13 people. In practice, the group labelled for AI access is, by membership, the executive tier of the department.

Among them, according to WIRED: former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer, who has returned to defence tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump's 2024 presidential campaign, according to his LinkedIn profile. None of the four responded to requests for comment.

Exempting leadership from a content filter is ordinary in itself. What the overlap exposes is how small the circle is. Thirteen accounts with the widest web access, named and listed in one place, are exactly the kind of high-value targets that security teams try to keep anonymous.

Where the data came from, and who disputes it

DDoSecrets says in a press release that the data comes from DHS's Okta login system, the service that handles employee sign-ins. Okta's answer was flat. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson told WIRED. Neither the hackers nor DHS has described how the records were actually obtained, so the two statements stand side by side for now.

DHS itself went no further than acknowledging a “potential breach.” A Homeland Security spokesperson said the department “is actively working to address the situation swiftly and effectively,” adding: “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

The rest of the federal response was quieter still. The Department of Justice did not respond to WIRED's request for comment, and the FBI referred the inquiry back to DHS.

A department that guards its own names

The leak lands in the middle of a fight over who gets to be anonymous. DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters and secure warrants for surveillance tools aimed at reporters.

At the same time, since the start of the second Trump administration, DHS and the wider federal government have moved to hide DHS employees' names and faces. The agency has also expanded its definition of doxing, a term that usually means publishing someone's home address and other personal details for malicious purposes, to cover the publication of basic facts about public employees, such as their names and titles. Under that definition, much of what is in Icepick would count.

Both sides can point to this leak. For DHS, it is evidence that officers face real targeting, coming soon after a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families; law enforcement agencies have arrested several suspects in that case and detained another alleged member. For the people publishing the data, the hackers' note makes the argument: an agency that collects information on the public should expect scrutiny of its own structure. The difficulty is that a directory of 41,000 people also sweeps up contractors and staff far from any controversial programme.

Limits, open questions and what to watch

The first open question is authenticity. Alexander Leslie, a national security expert at the threat intelligence company Recorded Future, framed his assessment carefully: “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS.” DHS has called it only a potential breach, and the department has not confirmed which records are accurate or how many of the people listed still hold the roles shown.

The second is compounding. Leslie also warned that the dataset becomes far more valuable when correlated with previously compromised information. Matching these work emails and phone numbers against older breaches, including the personal data ShinyHunters claimed to have taken from the FBI, is the obvious next step for anyone hostile, and the hardest damage for DHS to contain.

Watch for DHS's promised public update, any statement from Okta beyond its initial denial, and whether law enforcement moves against the Department of Peace as it did against suspected ShinyHunters members. Watch, too, for how DHS applies its broadened definition of doxing to people searching or reporting on the archive.

This article draws on Transport security has blocked a cleartext HTTP and answers to it (1, 2), on the Stack Exchange network, licensed under CC BY-SA 4.0.