A hacktivist group published personal records for more than 40,000 US Department of Homeland Security staff, exposing undercover agents and surveillance programs.
Calling itself Department of Peace, the group released the data online. Titled Icepick, the dump contains records for more than 41,000 employees and contractors.
The files list names and job titles. Work email addresses are included. Phone numbers and office locations appear in the records.
The department said it is addressing the situation and takes security threats seriously.
The leak covers about one-fifth of the DHS workforce. The agency employs 220,000 people.
Undercover staff are exposed, along with those in sensitive areas such as wiretapping. The interception of communications roles are also visible.
The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs.
The data shows which tools employees can access. Palantir's Falcon investigative platform is listed. PenLink is a phone and social media analysis tool. Mobile Fortify is a facial recognition app used by immigration agents.
AI platforms are also accessible to staff. These include OpenAI's ChatGPT. Google's Gemini and Microsoft's Copilot are listed.
The files detail specific communication programmes. They name the Communications Intercept Center TechOps (CICTO) Program and a Title III Intercept Program for wiretaps. The Illicit Sensor Intercept Program (ISIP) is also referenced.
Department of Peace claims the data came from an Okta system. DHS staff use this single sign-on service to log onto the central network.
Disputed entry point
Department of Peace claim
Source of breach
- Data taken from Okta single sign-on system
- Used by DHS staff for network login
Okta response
Security status
- No evidence systems were compromised
- No evidence data was compromised
We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.
Okta says its systems are secure. The vendor says there’s no evidence of a compromise.
Reuters matched personal information for six DHS employees against credit bureau records, which confirmed the details. Breach data from District 4 Labs also matched.
Three DHS employees confirmed their phone numbers and other details to reporters who called them directly. One employee said they had not previously heard about a breach.
Some data tracked information from LinkedIn profiles, while other parts revealed non-public internal organisation charts. The data also included previously undisclosed programmes, the department said.
By replacing the regime’s anonymity with accountability, Icepick and the tool developed by maia are catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests
Ryan Shapiro of Property of the People commented on the release. He said contact details could help researchers submit targeted FOIA requests.
A threat intelligence expert warned of the risks, saying the data is an extraordinarily valuable intelligence resource if authentic. Adversaries could identify vulnerable personnel.
Ongoing investigations could be compromised, and leaked contact details might be used in phishing attacks. Agents could face physical danger.
Department of Peace said this was linked to a previous breach. The group claimed to have stolen thousands of government contracts earlier this year.
The group said in March it was responsible for hacking DHS. It posted documents related to contracts with outside vendors.
Other US government agencies have also faced attacks. FBI records were recently exposed, and military personnel data was also leaked.
In September, ShinyHunters said it had stolen FBI employee details. Personal details related to nearly every employee were taken.
In a month, this is the third major government data leak. The disclosures have featured prominently in headlines.
| Agency | Estimated records |
|---|---|
| US Customs and Border Protection | Around 21,000 |
| Immigration and Customs Enforcement | Around 10,000 |
| US Citizenship and Immigration Services | Around 6,200 |
| Cybersecurity and Infrastructure Security Agency | Just under 1,000 |
| DHS headquarters and others | Thousands |
What we know
- More than 41,000 records were published.
- DHS is aware of the potential breach.
- Okta denies its systems were compromised.
Still unclear
- Exact method of breach remains unconfirmed by DHS.
- Full authenticity of the entire 40,000+ record trove is not yet verified.
- Okta's involvement is disputed by the vendor.
