Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents

The personal information of thousands of DHS employees, including undercover agents, is now publicly accessible.

A significant data leak, dubbed "Icepick," has exposed the personal information of approximately 41,000 Department of Homeland Security (DHS) workers, including undercover ICE agents. The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) and cybersecurity researcher maia arson crimew obtained the data, which they say originates from DHS's Okta login system and was published on Wednesday. The records, last updated on August 19, 2026, detail DHS employees, Immigration and Customs Enforcement (ICE), and US Customs and Border Protection (CBP) staff. According to DDoSecrets, the leak was a response to the DHS's aggressive pursuit of its critics and efforts to conceal employee information. The leaked dataset reveals access to sensitive internal systems, including those for undercover operations, wiretaps, and surveillance tools like Palantir's Falcon and PenLink. It also includes individuals with access to AI tools such as ChatGPT and Gemini, and personnel involved in sensitive roles like military processing support and National Guard operations. The leak follows a similar breach affecting FBI employees and comes as DHS has expanded its definition of "doxing" to include basic facts about public employees.

This leak represents a critical intelligence windfall for adversaries, enabling them to identify vulnerable personnel, craft sophisticated impersonation schemes, and potentially compromise ongoing investigations by correlating the data with other compromised information. The inclusion of access group names referencing "certified undercover operation," "Communications Intercept Center TechOps," and wiretapping programs, along with tools like Palantir and PenLink, suggests the data could expose operational methodologies and sensitive surveillance activities.

The exposed dataset's detail on permission groups and AI tool access, such as "Executive Leadership," "AI Access," and references to OpenAI and Google's Gemini, highlights vulnerabilities in how sensitive technologies and leadership positions are managed and secured within DHS. This breach may prompt a reevaluation of access controls, data handling protocols, and the security of third-party tools integrated into government systems, potentially impacting future technology adoption and vendor relationships.