Major US Homeland Security breach exposes details on 41,000 employees — undercover ICE agents and contractors unmasked in ‘Icepick’ data dump
DHS data breach exposes personal details of over 41,000 employees and contractorsThe information includes personal information on ICE agents, as well as details of surveillance operations and tools used by undercover agentsNumerous high-level officials across US government agencies have been named within the breach
The details of over 41,000 Department of Homeland Security employees and contractors has surfaced online, including staffers at Immigration and Customs Enforcement (ICE) and US Customs and Border Protection, following an apparent data breach.
The leak contains sensitive information such as email addresses, phone numbers, and office addresses for employees alongside internal information on how Homeland Security conducts undercover operations and surveillance programs.
The archive was published by a group calling itself the Department of Peace. They dubbed the leak ‘Icepick’, and shared a note stating, “They have our information, so it’s only fair that we have theirs.”
‘Icepick’ data dump exposes agents and contractors
The DHS has been locked in a battle with activists, protestors, and anonymous social media users who have been tracking and cataloguing the movements and behavior of ICE employees.
In response to protests and activist activity, the DHS has expanded its definition of “doxing” - the malicious exposure of personal information such as home addresses - to include basic information such as names.
The Icepick data leak has since been turned into a searchable database by Swiss cybersecurity researcher and journalist maia arson crimew, who said, “I don't think we should let them scare us into not looking into them.”
“The DHS especially as an agency completely lacks accountability, despite many parts of it being incredibly unpopular,” crimew said. “The people who work there know this too; for example, some of their LinkedIn bios simply say ‘stuff at US Government’.”
Of the 41,000 records exposed, around 10,000 belong to ICE employees, 6,200 belong to US Citizenship and Immigration Services, and a further 1,000 are Cybersecurity and Infrastructure Security Agency accounts.
Details on DHS operations contains references to “Keyhole” - an undercover surveillance of Minneapolis protest groups that took place earlier this year - alongside references to a Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”
Tools used by employees have also been revealed in the breach, which include Palantir’s Falcon investigative platform, the PenLink platform used to analyze phone records and social media, and AI platforms such as OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot.
According to the transparency nonprofit Distributed Denial of Secrets, who verified the leak on behalf of Wired, the data was obtained from the DHS's Okta login system. An Okta spokesperson said, “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.”
A DHS spokesperson said that the agency is “aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available”
