What we know so far: Hackers have leaked credentials for more than 41,000 Department of Homeland Security employees and contractors, revealing not only who works at the agency but also what surveillance and investigative tools they are allowed to use. Taken together, the files provide a rare glimpse into the technology behind the department’s investigations and the chain of command that guides them. The publication also heightens the debate over whether exposing the people behind federal immigration enforcement serves accountability or poses a security threat.
The nonprofit transparency organization Distributed Denial of Secrets released the archive, which it calls “Icepick,” on Wednesday. It includes DHS and seven of its component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection.
The files include email addresses, phone numbers and office addresses, as well as more than 55,000 permission groups that control access to internal systems. Some group names refer to Palantir and PenLink’s Falcon investigative platform, which analyzes phone records and social media. Others point to tools for retrieving data from confiscated phones, systems for accessing immigration court records, a Title III Intercept Program for wiretaps, a Communications Intercept Center TechOps (CICTO) Program, and an Illicit Sensor Intercept Program (ISIP).
Records were last updated in August. DDoSecrets says they came from DHS’s Okta filing system, which Okta denies. “We are aware of this report. Okta is secure and we have no evidence that our data or systems were compromised,” a company spokesperson told WIRED.
Almost everyone in the leak belongs to at least one of these groups, and the membership lists show who has what skills. At Homeland Security Investigations, ICE’s investigative division, 39 employees in more than a dozen field offices sit in groups called “CUC,” which stands for “Certified Undercover Operation,” according to government court documents. A group apparently affiliated with the HSI operations area in St. Paul, Minnesota, refers to “Keyhole.” Federal court filings describe Keyhole as a certified undercover operation that funded HSI’s covert surveillance of protest groups in Minneapolis earlier this year.
More than 200 CBP accounts belong to a group related to Mobile Fortify, the facial recognition app that immigration officials use to identify people. Members include field managers, special operations team members, and tactical and intelligence agents. More than 700 accounts, almost all of them CBP, are linked to a group that appears to reference the encrypted messaging app Signal.
Other groups point to AI tools, including OpenAI’s ChatGPT, Google’s Gemini and Microsoft’s Copilot. One, called “Grok.com,” includes eight DHS technology officials, including the department’s former chief information officer and chief data officer.
Two others, “Executive Leadership” and “AI Access,” appear to list people exempt from the DHS web filter, which blocks some websites from employees. Both list the same 13 people, including former DHS Director Kristi Noem; Antoine McCord, the recently departed CIO who has returned to defense technology company Anduril; Philip Hegseth, a senior adviser to the secretary and younger brother of Defense Secretary Pete Hegseth; and political consultant Jayce Krachenfels. None of the four responded to requests for comment.
Most records also identify a supervisor so that the data can be used to rebuild reporting lines across the department. More than 300 records belong to senior headquarters officials, including those in charge of intelligence, technology, biometrics and privacy.
Alexander Leslie, a national security expert at threat intelligence firm Recorded Future, says if the data is real and up-to-date, it would be an extremely valuable intelligence resource for anyone trying to penetrate DHS. He adds that its value increases when combined with previously stolen information, commercial data and other information. He says an adversary could spend months using those connections to find at-risk employees, convincingly impersonate employees or jeopardize ongoing investigations.
A WIRED analysis found that CBP employees account for more than half of the records. ICE accounts for about 10,000, about a third in HSI. The U.S. Citizenship and Immigration Services has 6,200 people, and nearly 1,000 are affiliated with the Cybersecurity and Infrastructure Security Agency. Together they make up about a seventh of the DHS workforce.
The account data also tracks the execution structure. Approximately 1,300 ICE enforcement accounts were created after July 2025, when Trump signed the One Big Beautiful Bill Act, which funded 10,000 new ICE enforcement and layoff officers through the end of 2025. Nearly 20 accounts appear to belong to Department of Defense employees, eight of them in a group titled “ICE Tip Line DOW Surge.” About 170 accounts provide “military processing support” at ICE facilities and 35 identify National Guard members.
DDoSecrets and researcher and journalist Maia Arson Crimew say the files came from a group calling itself the “Department of Peace.” “They have our information, so it’s only fair that we have theirs,” the hackers wrote. Crimew has created a website that makes the records searchable. “I don’t think we should let them intimidate us into not taking care of them,” she told WIRED.
The release comes as DHS works to keep its employees away from the public. The department has sought to expose anonymous online critics and has expanded its definition of doxing to include publishing the names and titles of employees. In June, 15 Minnesota residents were charged with stalking and threats that prosecutors linked to anti-ICE activity.
Adam Steinbaugh, a senior attorney for the civil rights group FIRE, says the government has taken a broad view of 18 USC 119, which prohibits the disclosure of “limited personal information” about federal officials with the intent to threaten them. “This is information that would be on a business card,” he says. “This is not something the government can criminalize.”
DHS and the Justice Department did not respond to WIRED. The FBI referred questions to DHS.
