41,000 US Homeland Security Workers Exposed in Major Hack as Tom Homan Warns ICE Agents Face Risks

Hackers have exposed personnel records belonging to more than 41,000 US Department of Homeland Security (DHS) employees and contractors, including ICE and border personnel, in a searchable database that reveals details of the department's internal structure and references to sensitive operations.

The leaked information includes names, job titles, work email addresses, phone numbers and office locations. It also contains internal access-group memberships that could reveal which personnel have access to surveillance technologies, immigration databases and undercover operations.

Dubbed 'Icepick', the archive was published by the transparency non-profit Distributed Denial of Secrets (DDoSecrets) after receiving the material from a hacker group calling itself the Department of Peace. The records cover DHS and seven component agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP) and the Cybersecurity and Infrastructure Security Agency (CISA).

Undercover Personnel and Operations

The leaked information includes approximately 21,000 CBP records and around 10,000 associated with ICE and its Homeland Security Investigations (HSI) unit. Another 6,200 records reportedly relate to US Citizenship and Immigration Services (USCIS).

Beyond basic contact details, some records identify employees' membership in internal access groups, potentially revealing which systems and applications they can access.

WIRED's investigation identified 39 HSI employees across more than a dozen field offices in groups whose names include 'CUC', which court filings identify as meaning 'certified undercover operation'. Another group, apparently associated with HSI's St Paul area of operations, referenced 'Keyhole', a certified undercover operation that court filings say recently funded HSI surveillance of protest groups in Minneapolis.

Other group names reference wiretap programmes, communications interception and systems used to access immigration records.

The exposure could leave personnel more vulnerable to targeted phishing, harassment or attempts to identify those involved in sensitive operations. However, the sources do not establish that these risks have resulted in specific incidents.

The hacker group justified the disclosure in a note accompanying the data, saying: 'They have our information, so it's only fair that we have theirs.'

Links to Surveillance Technology

The records may also shed light on the technologies available to immigration and border personnel.

TechCrunch reported that more than 2,000 HSI users were associated with internal groups referencing PenLink, a company whose tools are used to analyse phone records and social media data. The dataset also identified more than 200 CBP accounts associated with Mobile Fortify, a facial-recognition application used by immigration agents.

WIRED also identified references to Palantir's Falcon investigative platform, alongside groups associated with wiretapping and other surveillance capabilities.

The group memberships indicate potential access to these technologies rather than proving that every listed employee actively used them.

DHS Responds as Okta Denies Compromise

The hacker group claimed to have obtained the records through an Okta single sign-on system used by DHS employees and contractors to access internal networks.

However, the precise method of intrusion has not been independently established. Okta told TechCrunch: 'Okta is secure, and we have no evidence our data or systems were compromised.'

DHS said it was aware of a potential breach, with a spokesperson stating: 'DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively.'

The spokesperson added: 'We take all security threats against our employees and officers seriously and will work to ensure all are properly protected.'

The DHS leak comes amid wider concerns about the exposure of US government personnel records. TechCrunch and WIRED have also reported a separate incident in which hackers known as ShinyHunters claimed to have stolen personal information belonging to FBI employees and their families. The incidents have not been linked.

Homan Condemns Leak as ICE Agents Face Risks

White House border official Tom Homan has condemned the exposure of DHS personnel records, saying the disclosure could put employees at greater risk.

Speaking at a news conference in Miami on Thursday, Homan said the Justice Department was investigating the breach. He also pointed to increased threats and attacks against ICE officers since President Donald Trump began his second term.

'I want the American people to know that ICE agents are mothers and fathers, too. They have families, too,' Homan said. 'They don't hang their heart on a hook when they come into work. They got a difficult job, a dangerous job.'

Homan urged people who disagree with ICE's enforcement activities to contact their lawmakers and seek changes to the immigration laws officers are responsible for enforcing.

Bluesky Blocks Links to Archive

As the dataset circulated online, social media platform Bluesky began blocking links to the leaked archive and a website created to search the records.

WIRED reported that Bluesky labelled the links 'malicious', citing its rules against sharing people's personal contact information without authorisation.

The platform said it had blocked the links 'to avoid limiting public discussion or restricting broader access to reporting and commentary.'

The restrictions apply to links to the archive and searchable database rather than all posts discussing the incident. WIRED also found that at least one third-party Bluesky application continued to open the links.

The decision highlights the tension between protecting government employees' privacy and allowing public-interest reporting about the activities of federal agencies.

DDoSecrets published the archive, while journalist and hacker maia arson crimew developed the searchable website. The database offers an unusually detailed picture of DHS personnel, internal reporting relationships and potential access to government systems.