Hacker calling themselves Department of Peace steals personal data of more than 40,000 DHS employees and publishes it online via DDoSecrets

A hacker calling themselves Department of Peace has stolen personal data of more than 40,000 DHS employees and published the records online via the transparency group Distributed Denial of Secrets. The breach, disclosed on Wednesday, drew on information obtained through an Okta single sign-on system used by the department, according to the hacker’s claim.

The dataset, named Icepick, contains names, job titles, phone numbers, and email addresses of employees from across the Department of Homeland Security, including Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, U.S. Citizenship and Immigration Services, and the Federal Protective Service. The number of leaked records is equivalent to roughly one-fifth of Homeland Security’s 220,000-person workforce.

What the data reveals

The leaked records reveal which agents were assigned to special operations, surveillance jobs, computer forensics, and undercover work, according to job titles and email groups included in the dataset. The information also contains dozens of previously unknown operation names, the agents who led and worked on those operations, and some of the technology they used, including tools provided by Cellbrite and Palantir. In several cases, the data tracked information available on employees’ LinkedIn profiles, but in others it revealed nonpublic data about internal DHS organization charts or previously undisclosed programs or operations.

Dozens of user groups in the dataset reference PenLink, a web surveillance company whose technology can track location data from mobile devices, with groups varying in size from a handful of users in local offices to more than 2,000 users across ICE’s HSI unit nationally. One group specifically references PenLink PLX, which the company says is used to capture and analyze real-time intelligence from phone calls, texts, web activity, and social media. More than 200 CBP users are associated with Mobile Fortify, a facial-recognition app used by both CBP and ICE agents. Around 4,500 users, including ICE agents and deportation officers, are members of a group called Headspace_users; Headspace previously had an $82,500 federal contract with ICE that ended in 2023. Other groups are associated with investigations into the China-backed hacking groups known as Salt Typhoon and Volt Typhoon, and several employees associated with ChatGPT access include senior DHS officials.

Agency breakdown and verification

More than 21,000 records relate to CBP employees, and approximately 10,000 records are associated with ICE and its HSI unit, per TechCrunch. Just under 1,000 employees at CISA appear in the data. The thousands of employee directory records appear to have been exfiltrated around mid-August, according to timestamps on each person’s record. TechCrunch verified a portion of the data as authentic by matching the names of several known Homeland Security employees against an offline copy of the database. Reuters matched about six employees to credit bureau records and confirmed phone numbers by calling three employees directly.

How the breach occurred

The hacker claimed to have obtained the data through Okta, a single sign-on service used by DHS to allow employees and contractors across its agencies to log in to its central network. Okta responded saying it is secure and has no evidence its data or systems were compromised. The stolen data was shared with journalist and hacker maia arson crimew, who then shared a copy with DDoSecrets. Department of Peace previously claimed responsibility for hacking DHS and posting documents related to contracts with outside vendors.

Motive and message

In a statement included with the data, Department of Peace wrote: “They have our information, so it’s only fair that we have theirs.” DDoSecrets co-founder Emma Best said the aim was to replace anonymity with accountability. Best said the leak identifies officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers, the failed BlueLeaks investigation, and key personnel in DHS’s rendition and deportation programs. BlueLeaks refers to a massive leak of U.S. police data in 2020, which DDoSecrets also hosted. A Department of Peace spokesperson referenced Markwayne Mullin, who became DHS Secretary in March, saying that when Mullin said on July 17th he was turning up the heat, the group’s response was that this is what happens to ICE when you do that.

Ryan Shapiro, executive director of the transparency nonprofit Property of the People, said exposed email addresses and phone numbers are indispensable tools for FOIA researchers. Shapiro said, “Given the Trump administration’s contempt for even basic transparency, the need for such tools is urgent.”

A wave of government breaches

The leak is described as the third government data leak to make headlines in recent weeks. In September, the FBI was hacked by a group called ShinyHunters, which stole sensitive job details and medical information from thousands of bureau employees. Last week, the defense department was hit with a class action lawsuit following a breach that exposed data on millions of current and former military personnel. In recent days, the Federal Election Commission was taken offline because of a suspected hacking attempt. DHS did not immediately respond to requests for comment.