Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
The spreadsheet hit the servers at 2:00 AM Eastern Time. It wasn’t a trickle; it was a firehose of 41,000 names, phone numbers, and internal group memberships that mapped out the quiet, ugly machinery of the Department of Homeland Security.
The “Icepick” Files Land on Public Servers
Distributed Denial of Secrets, the nonprofit that holds the archive, released what they are calling “Icepick” on a Wednesday morning that felt suspiciously quiet. The data isn’t just a list; it’s a skeleton key to how the agency actually functions behind the badge. The records were last touched on August 19, 2026, a date that suggests the snapshot is recent enough to be dangerous for the people inside it. If you work at CBP, you are probably dreading your phone lighting up right now.
The source, a hacker group calling itself the Department of Peace, left a note that reads like a ransom demand from a very angry kid. “They have our information, so it’s only fair that we have theirs,” the note said, a line that journalists have seen a hundred times but rarely so bluntly tied to government staff. The files include email addresses, physical office locations, and even the specific cellphone numbers of agents who are supposed to be ghosts. It’s a digital dox of a federal agency, and it smells like revenge. More importantly, it smells like trouble for anyone relying on anonymity to do their job.
Undercover Ops and the “Keyhole” Program
Inside the data, buried under layers of permission groups, are the names of 39 employees across more than a dozen field offices who belong to groups labeled “CUC.” Court filings confirm “CUC” stands for Certified Undercover Operation, a designation that carries serious legal weight and even heavier personal risk. One specific group, based out of the St. Paul area, references “Keyhole,” a program used recently to surveil protest groups in Minneapolis. That connection is not subtle, and it doesn’t sit well with civil liberties advocates who have been watching HSI for years.
Other names in the leak point to things like the “Communications Intercept Center TechOps” and the “Title III Intercept Program,” which are essentially the plumbing of state-sanctioned wiretaps. There is also a group for the “Illicit Sensor Intercept Program,” which sounds like something out of a spy novel but is very real federal infrastructure. The detail that hurts is the correlation: these aren’t random staff, they are the people with eyes on the ground and ears on the phones. If you are tracking a journalist or a protest organizer, the people doing the tracking just got a lot harder to hide from. The implications for ongoing investigations are severe, to put it mildly.
Palantir, Grok, and the AI Access List
The leak reveals that DHS isn’t just using old-school surveillance tools; they are deep in the AI stack, and the names attached to those tools are not minor players. A permission group explicitly named “Grok.com” lists eight technology officials, including the department’s former chief information officer and chief data officer. This confirms that xAI’s model is being used for more than just chat experiments; it’s being wired into operational workflows. The same group includes access to OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot, a tech stack that would make any Silicon Valley office jealous of its redundancy.
Perhaps the most jarring entry is the “Executive Leadership” and “AI Access” group, which contains the same 13 people and appears to grant exceptions to the DHS web filter. On that list are names like Kristi Noem, former DHS head, and Philip Hegseth, a senior advisor who is also the younger brother of defense secretary Pete Hegseth. Jayce Krachenfels, a policy adviser, is there too, and his LinkedIn profile says he was a regional field director for Trump’s 2024 campaign. The mixing of political appointments and technical access to AI tools raises immediate separation-of-powers questions that Congress will likely want answered very, very loudly.
Okta Denies the Breach, Citing System Security
Okta, the identity provider that handles the login systems for DHS, issued a statement that was as cold and generic as a bank’s denial of a fraudulent charge. A spokesperson told reporters that the company is unaware of any breach of its systems and that “Okta is secure.” They stated they have no evidence their data or systems were compromised, a standard line that has done nothing to calm nerves in the tech sector lately. The leak claims to come directly from Okta’s login system, which means the breach likely happened at the authentication layer, not in a database dump. That distinction is technical but crucial for understanding how the data was lifted.
DHS and the Department of Justice did not respond to requests for comment before this deadline, a silence that speaks volumes in a crisis. The FBI referred all inquiries directly to DHS, which is a bureaucratic way of saying “this is your problem, not ours.” Okta’s denial might hold up in a legal forum, but it doesn’t change the fact that the data exists and it’s public. The agency has spent the last two years trying to hide its workforce from public view, and now a single file has undone that effort. It’s a logistical nightmare for security teams who didn’t think they needed to check their server logs for a specific leak.
The Doxing Backlash and Future Risks
Since the second Trump administration took office, DHS has aggressively pursued critics by seeking to unmask anonymous social media users and obtain customer records on protestors. The definition of “doxing” was expanded to include the publication of basic facts about public employees, like names and titles, a move designed to chill legitimate journalism and oversight. Now, the very act DHS tried to make a crime has been executed at a massive scale against the agency itself. It’s a bitter irony that the tools of suppression have been turned around and used against the suppressors. The legal team at the Justice Department is probably having a very long weekend right now.
Security researcher maia arson crimew, who previewed the data with DDoSecrets, built a searchable website for the records, arguing that transparency trumps the agency’s desire for obscurity. “I don’t think we should let them scare us into not looking into them,” she said, a sentiment that resonates with anyone who has been threatened for doing their job. The 41,000 individuals in this list now have to weigh the risk of physical retaliation against the reality that their data is already out there. For undercover agents, that risk is immediate and visceral, not theoretical. The next few days will determine if this leak changes how federal agents operate on the street.
Frequently Asked Questions
Who is behind the leak?
A group calling itself the “Department of Peace” claims responsibility for the release. They provided the data to Distributed Denial of Secrets, which then published the archive. The primary records show office locations and work cellphone numbers, not private residential addresses. However, the data is detailed enough to identify agents and their work hours.
Does the leak contain home addresses?
Will DHS fire the employees listed?
It is highly unlikely they would fire staff for a data breach they didn’t commit, but they may reassign undercover agents for safety. The agency is currently not responding to inquiries. No, this leak specifically targets Department of Homeland Security employees and contractors. Private citizens are not included in the 41,000 records released by DDoSecrets.
Is my personal data in this leak?
What is the “Icepick” archive?
“Icepick” is the name given to the leaked DHS records by Distributed Denial of Secrets. It contains personnel data, internal group memberships, and access permissions. Source: Wired
This article was compiled by the IndiaBBCNews editorial system from verified international news sources. Facts have been independently reviewed. Original reporting: Wired.
