What we know so far: Hackers have leaked login records for more than 41,000 Department of Homeland Security employees and contractors, revealing not only who works at the agency but also which surveillance and investigative tools they are cleared to use. Taken together, the files offer a rare inside look at the technology behind the department's investigations and the chain of command that directs them. The release also sharpens the debate over whether exposing the people behind federal immigration enforcement serves accountability or creates a security threat.
The transparency nonprofit Distributed Denial of Secrets published the archive, which it calls "Icepick," on Wednesday. It spans DHS and seven of its component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection.
The files include email addresses, phone numbers and office addresses, along with more than 55,000 permission groups that control access to internal systems. Some group names reference Palantir's Falcon investigative platform and PenLink, which analyzes phone records and social media. Others point to tools for pulling data from seized phones, systems for reaching immigration court records, a "Title III Intercept Program" for wiretaps, a "Communications Intercept Center TechOps (CICTO) Program" and an "Illicit Sensor Intercept Program (ISIP)."
The records were last updated in August. DDoSecrets says they came from DHS' Okta login system, which Okta disputes. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," a company spokesperson told Wired.
Nearly everyone in the leak belongs to at least one of these groups, and the membership lists show who holds which capabilities. At Homeland Security Investigations, ICE's investigative arm, 39 employees in more than a dozen field offices sit in groups named "CUC," which government court filings say stands for "certified undercover operation." A group that appears tied to HSI's St. Paul, Minnesota, area of operations references "Keyhole." Federal court filings describe Keyhole as a certified undercover operation that funded HSI's undercover surveillance of Minneapolis protest groups earlier this year.
More than 200 CBP accounts belong to a group referencing Mobile Fortify, the face-recognition app immigration agents use to identify people. Members include field supervisors, special response team operators and tactical and intelligence agents. More than 700 accounts, nearly all of them CBP, link to a group that appears to reference the encrypted messaging app Signal.
Other groups reference AI tools, including OpenAI's ChatGPT, Google's Gemini and Microsoft's Copilot. One, labeled "Grok.com," includes eight DHS technology officials, among them the department's former chief information officer and chief data officer.
Two more, "Executive Leadership" and "AI Access," appear to list people exempted from the DHS web filter that blocks some sites for employees. Both list the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed CIO who has returned to defense tech company Anduril; Philip Hegseth, a senior adviser to the secretary and younger brother of defense secretary Pete Hegseth; and policy adviser Jayce Krachenfels. None of the four responded to requests for comment.
Most records also name a supervisor, so the data can be used to rebuild reporting lines across the department. More than 300 records belong to senior headquarters officials, including those overseeing intelligence, technology, biometrics and privacy.
Alexander Leslie, a national security expert at threat intelligence company Recorded Future, says that if the data is real and up to date, it is an extremely valuable intelligence resource for anyone trying to get inside DHS. He adds that its value grows when combined with previously stolen information, commercial data and other intelligence. He says an adversary could spend months using these connections to find vulnerable employees, convincingly impersonate staff, or compromise ongoing investigations.
A Wired analysis found CBP staff make up more than half the records. ICE accounts for about 10,000, roughly a third in HSI. US Citizenship and Immigration Services has 6,200, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency. Together, they make up about a seventh of the DHS workforce.
The account data also tracks the buildup of enforcement. About 1,300 ICE enforcement accounts were created after July 2025, when Trump signed the One Big Beautiful Bill Act, which paid for 10,000 new ICE Enforcement and Removal officers by the end of 2025. Nearly 20 accounts appear to belong to Defense Department personnel, eight in a group titled "ICE Tip Line DOW Surge." About 170 accounts provide "military processing support" at ICE facilities, and 35 identify National Guard members.
DDoSecrets and the researcher and journalist Maia Arson Crimew say the files came from a group calling itself the Department of Peace. "They have our information, so it's only fair that we have theirs," the hackers wrote. Crimew built a website that makes the records searchable. "I don't think we should let them scare us into not looking into them," she told Wired.
The release comes as DHS works to keep its staff out of public view. The department has sought to unmask anonymous online critics and broadened its definition of doxing to include publishing employees' names and titles. In June, 15 Minnesota residents faced stalking- and threat-related charges that prosecutors linked to activities opposing ICE.
Adam Steinbaugh, a senior attorney at the civil liberties group FIRE, says the administration has taken an expansive view of 18 USC 119, which bars sharing "restricted personal information" about federal officers with intent to threaten them. "This is information that would be on a business card," he says. "That's not something the government can criminalize."
DHS and the Justice Department did not respond to Wired. The FBI referred questions to DHS.