A massive data leak, dubbed "Icepick" by its publishers, has exposed sensitive details pertaining to over 41,000 employees and contractors across the **Department of Homeland Security (DHS)** and its seven component agencies. This includes critical entities like **Immigration and Customs Enforcement (ICE)** and **US Customs and Border Protection (CBP)**. The records, reportedly last updated on August 19, 2026, were previewed for WIRED by the transparency nonprofit **Distributed Denial of Secrets (DDoSecrets)** and cybersecurity researcher and journalist **maia arson crimew**. They claim the data originated from a group calling itself the **Department of Peace**. ## Unveiling Internal Systems and Surveillance Capabilities **DDoSecrets** published the archive, stating the data was sourced from DHS's **Okta** login system. The hackers included a note: “They have our information, so it’s only fair that we have theirs.” An **Okta** spokesperson, however, told WIRED, “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.” The leak provides a granular view of DHS's internal structure and operational methodologies. A WIRED analysis revealed that **CBP** staffers account for over half of the records, with **ICE** comprising approximately 10,000 entries, a third of which are within **Homeland Security Investigations (HSI)**. **US Citizenship and Immigration Services** accounts for 6,200, and nearly 1,000 are tied to the **Cybersecurity and Infrastructure Security Agency (CISA)**. ## Undercover Operations and Advanced Tools Revealed The leaked records detail permission groups, providing insight into access control for internal systems. Notably, 39 **HSI** employees are linked to groups with names including “CUC,” which government court filings identify as **“certified undercover operation.”** Another group references “Keyhole,” a certified undercover operation that funded **HSI**'s surveillance of Minneapolis protest groups. Other references include a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).” The more than 55,000 permission groups also hint at the use of advanced tools for accessing immigration court records, extracting data from seized phones, and conducting surveillance. These include **Palantir**’s Falcon investigative platform and **PenLink**, used for analyzing phone and social media records. ## Executive Access and AI Tools in Focus Two permission groups, “Executive Leadership” and “AI Access,” appear to grant exceptions to DHS's web filter. These groups list the same 13 individuals, including former DHS head **Kristi Noem**, recently departed DHS Chief Information Officer **Antoine McCord**, and senior adviser **Philip Hegseth**. Other groups reference prominent AI tools such as **OpenAI**’s ChatGPT, **Google**’s Gemini, and **Microsoft**’s Copilot. One group, named “Grok.com,” includes eight DHS technology officials, signaling the department's engagement with emerging AI capabilities. Alexander Leslie, a national security expert at **Recorded Future**, commented on the gravity of the leak: “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS. This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.” ## Encrypted Communications and Biometric Systems Over 700 accounts are associated with **Signal**, the encrypted messaging app, predominantly belonging to **CBP** personnel. Additionally, more than 200 **CBP** accounts are linked to **Mobile Fortify**, a facial recognition app used by immigration agents. This group includes field supervisors, special response team operators, and tactical and intelligence agents. Since July 4, 2025, when the **One Big Beautiful Bill Act** funded the hiring of 10,000 new **ICE Enforcement and Removal** officers, approximately 1,300 **ICE** enforcement accounts have been created. ## Inter-Agency Collaboration and Contractor Details The leak also reveals connections to the **Department of Defense**, with nearly 20 accounts, eight of which are in a group titled “ICE Tip Line DOW Surge.” Around 170 accounts are listed as providing “military processing support” at **ICE** facilities, and 35 explicitly identify **National Guard** members. Furthermore, dozens of accounts belong to local law enforcement personnel with titles like “Designated Immigration Officer” and “287(g) Officer,” authorized to perform immigration enforcement duties. The records also list roughly 4,400 “associates,” including IT developers, data scientists, nurses, and detention officers, with 145 identified as “contractor” or “high risk contractor.” Over 300 records reference senior DHS headquarters titles, providing a potential organizational chart from top leadership to individual immigration agents and detention contractors. Each record typically includes a supervisor's name, enabling the reconstruction of reporting relationships across the department. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a Homeland Security spokesperson told WIRED. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”