DHS personnel leak exposes contact details and sensitive job information

Searchable records identifying more than 41,000 current and former Department of Homeland Security employees and contractors were published Wednesday, exposing contact information and details about sensitive assignments across the department, according to the organizations behind the release.

The transparency nonprofit Distributed Denial of Secrets — known as DDoSecrets — said it received the data from a hacktivist group calling itself the Department of Peace. The group claimed to have obtained the records through an identity service used by DHS. Famed Swiss hacker and journalist known as “maia arson crimew” also had involvement. She said in an X post that she was not involved in procuring the data and “worked on this story as a journalist conducting source work, research and data work.”

The information includes names, phone numbers, email addresses, job titles and internal group memberships, with records covering Immigration and Customs Enforcement, Customs and Border Protection, the Cybersecurity and Infrastructure Security Agency and other parts of DHS. Some entries describe roles involving surveillance, computer forensics and undercover work.

Nextgov/FCW corroborated portions of the data, including one official’s work phone number that the reporter for this story had independently obtained before the leak. Checks of several other listed numbers showed they were associated with AT&T, which provides communications services to DHS. LinkedIn profiles for several people named in the data also matched the job titles and positions listed in the records.

Some of the records also appear to be historical. Nextgov/FCW identified names of employees in CISA who have since left their roles at the cyberdefense agency housed in DHS.

DHS said it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.” The department said it was working to protect employees and would provide more information when available.

The release, dubbed “Icepick,” offers a view into how personnel and responsibilities are organized across DHS. Its publishers described that visibility as a tool for public accountability. The exposure of employees’ assignments and professional connections can also help malicious actors identify sensitive targets and craft convincing impersonation attempts. 

The Department of Peace said the breach was a response to DHS Secretary Markwayne Mullin’s pledge to intensify immigration enforcement.

“On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” a group spokesperson told the outlet. The group previously claimed a DHS hack involving contractor records in March.

DDoSecrets co-founder Emma Best said the latest release could support journalism, public records requests and congressional oversight. 

The hackers said they collected the data from an Okta single sign-on service used by DHS. Such services let employees access multiple workplace applications through one login. Okta said it was aware of the reporting but had found no evidence of a compromise of its own systems.

“Okta is secure, and we have no evidence our data or systems were compromised,” a company spokesperson said.

The disclosure follows other recent incidents involving federal personnel information. A breach claimed by criminal hacker group ShinyHunters exposed sensitive FBI employee records, including information about intelligence and surveillance roles. Separately, a Defense Manpower Data Center breach affecting roughly 3 million people involved months of unauthorized access to a file-sharing system. 

DHS has also faced scrutiny over its ability to detect intrusions. Earlier this year, personnel twice dismissed signs of hackers inside the Homeland Security Information Network before confirming a breach, Nextgov/FCW first reported.