A database containing information on more than 41,000 employees and contractors of the U.S. Department of Homeland Security (DHS) appeared online on Wednesday. The dataset, dubbed Icepick, includes names, job titles, phone numbers, work email addresses, and office locations; it also links some personnel to internal groups and tools that can be used for surveillance.
Distributed Denial of Secrets (DDoSecrets), a nonprofit organization that publishes leaked datasets, hosted the file on October 28. The hacktivist group Department of Peace said it obtained the records from an Okta single sign-on system used by DHS. The leak affects personnel from several agencies, including Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), the Cybersecurity and Infrastructure Security Agency (CISA), and U.S. Citizenship and Immigration Services (USCIS).
“They have our information, so it’s only fair that we have theirs.”
— Department of Peace
What the records show
According to TechCrunch, around 21,000 records belong to CBP employees. That agency operates at airports and other points of entry into the country. The same outlet counts about 10,000 records associated with ICE and its Homeland Security Investigations (HSI) unit, and just under 1,000 belonging to CISA. There is also data on personnel at DHS headquarters and other agencies, including the Federal Protective Service.
The Verge, citing TechCrunch and WIRED, separates the ICE and HSI data: it says that nearly 7,000 records belong to ICE employees and confirms that HSI records are included. The figures describe different categories, so they should not be treated as directly equivalent counts. TechCrunch says the records’ timestamps point to an extraction around mid-August. The outlet verified some of the data by comparing names against an offline copy of the database; it estimates that the leaked volume is roughly one-fifth of the DHS workforce.
The information is not limited to contact directories. The records include memberships in the department’s active directory user groups, which manage access to internal tools and services. TechCrunch found groups related to Microsoft 365, Adobe Acrobat, and Citrix, as well as others that can identify potential access to specific technologies.
These include groups associated with Penlink, a company whose products can collect and analyze data from phones and online services. Some groups include more than 2,000 HSI users. There are also more than 200 CBP users linked to Mobile Fortify, a facial recognition app used by CBP and ICE agents to identify people and check their information and immigration status. The records also mention groups related to ChatGPT and investigations into the Salt Typhoon and Volt Typhoon cyberattack groups.
Another group, Headspace_users, includes around 4,500 users, including ICE agents and deportation officials. TechCrunch reports that Headspace had an $82,500 federal contract with ICE, which ended in 2023, to fund mental health software for employees in its deportation unit. The company told the outlet that it has not provided services to DHS or ICE since that year.
Official response and access to Icepick
A DHS spokesperson told TechCrunch that the agency is aware of a potential breach and is working to address the situation and protect its employees and agents. The spokesperson added that the agency will provide more information when it becomes available. Okta, for its part, said it was aware of the news and stated that it has no evidence its systems or data were compromised.
DDoSecrets received a copy of the data through journalist and cybersecurity researcher maia arson crimew, who also created an online tool for searching the records. DDoSecrets describes Icepick as an internal DHS database obtained from an Okta sign-on service. The organization says the tool allows users to search and filter the original data; its publication includes download and torrent options.
The release has also prompted a response from Bluesky. WIRED reported that the social network blocks links to the file and search tool on its website and app, labeling them as malicious. Bluesky explained that the data contains personal contact information shared without authorization and that it blocked the links, rather than removing individual posts, to avoid limiting public debate or access to news coverage. The network did not tell WIRED whether the block was automatic or requested by a government agency.
DHS said it will update the public when more information becomes available. For now, the known scope includes immigration agencies, cybersecurity personnel, and department officials; the outstanding question is whether the access that led to the leak has been shut down.
Sources: The Verge, TechCrunch, WIRED, Distributed Denial of Secrets
