A newly published archive covering more than 41,000 Department of Homeland Security employees and contractors offers far more than a simple staff directory. Released on October 28, 2026 under the name “Icepick” by the transparency-focused publisher Distributed Denial of Secrets (DDoSecrets), the collection was attributed to a group calling itself Department of Peace, and includes internal reporting structures and system permission data that go well beyond typical contact information. Researcher and journalist Maia Arson Crimew built a search tool so reporters and the public can query the records.

What’s Inside the Archive

According to reporting on the leak, the data was last updated internally on August 19, 2026, and includes employee names, email addresses, phone numbers, office locations, job titles, and supervisory chains. The records span DHS headquarters and seven component agencies: Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), the Cybersecurity and Infrastructure Security Agency (CISA), and others. CBP accounts for more than half the entries, roughly 10,000 relate to ICE, about 6,200 cover US Citizenship and Immigration Services, and nearly 1,000 touch CISA. DDoSecrets frames the roughly one-seventh slice of the department’s workforce as material that supports journalism, oversight, and public-records research.

Undercover Identities Among the Exposed Data

The most sensitive dimension of the leak is not the directory information itself but more than 55,000 internal permission groups attached to the records, which govern access to DHS systems. Reporting from WIRED identified 39 Homeland Security Investigations staff listed in groups containing the abbreviation “CUC,” a designation that government court filings associate with certified undercover operations. Other groups reference wiretap authority, phone-record analysis, and surveillance tooling — the kind of metadata that, paired with a name and phone number, could meaningfully increase risk to the people involved, even though membership in a group is not definitive proof of someone’s current assignment.

A Disputed Path Into the Data

DDoSecrets says the material originated from an Okta single sign-on deployment used by DHS, but Reuters reports it was unable to independently confirm that claim, and Okta has stated its own systems are secure with no evidence of a breach on its end. That distinction is important: a claim that data was taken from an organization’s identity system is not the same as a confirmed breach of the identity provider itself. Attackers have separately targeted Okta customer accounts in the past using social-engineering tactics such as fraudulent help-desk calls, but no evidence ties that method to this specific leak, and no confirmed entry point for the DHS data has been disclosed.

Partial but Credible Verification

Reuters says it could not verify the entire 41,000-record archive but did cross-check details for six employees against other sources, confirming phone numbers and other personal information by directly calling three of them. Some entries lined up with employees’ public profiles, while others revealed internal assignments that had not previously been disclosed. Threat intelligence expert Alexander Leslie of Recorded Future told WIRED that combining names with supervisors, duties, and direct phone numbers gives adversaries a ready-made toolkit for identifying vulnerable staff, crafting convincing impersonation attempts, or pressuring ongoing investigations.

Part of a Wider Pattern of Breaches

The DHS leak follows a string of related incidents: ShinyHunters claimed in September to have stolen FBI personnel data, and an October lawsuit raised allegations tied to a separate Defense Department breach affecting millions of records. Investigators have not established a common cause linking these incidents, but together they point to a sustained wave of interest in US federal employee data from multiple threat actors.

Why This Matters

For the individuals named in the Icepick archive, the exposure raises concrete personal-safety concerns, particularly for anyone connected to undercover work. For DHS and its component agencies, the leak is a reminder that identity data and access-permission records can be just as damaging in the wrong hands as the credentials they’re meant to protect. Security teams across government and critical infrastructure should treat this incident as a prompt to review how tightly internal group memberships and contact directories are segmented from broader single sign-on environments, regardless of how this particular data was obtained.