Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents
On October 28, 2026, the transparency nonprofit Distributed Denial of Secrets published a searchable archive it calls Icepick. WIRED previewed the data and reported the release. Help Net Security, citing the same dataset, counts 41,191 personnel entries across seven DHS components and 55,603 internal groups. Customs and Border Protection holds the largest share, with 21,329 entries. WIRED's own count put ICE at about 10,000 records, roughly a third of them in Homeland Security Investigations, while other outlets put the ICE figure near 6,600.
The most sensitive layer is the access structure. The archive includes more than 55,000 permission groups that control access to internal systems. WIRED found 39 Homeland Security Investigations employees in groups containing the term "CUC," which court records link to certified undercover operations. The Next Web reports that other groups are tied to wiretap programs and Palantir software.
The hacktivist group Department of Peace says it pulled the records through DHS's Okta single sign-on service. Okta disputes this and says it has no evidence its systems were compromised. Reuters could not authenticate the full set, but it matched six named employees to credit bureau records and breach data and phoned three of them. One said it was the first they had heard of a breach. DHS says it is investigating.
Why it matters
For AI companies, the core lesson is that access metadata can reveal as much as the core records. Group names, role tags and reporting lines let an outsider map who works on sensitive projects without opening a single document. Founders with government or regulated customers should check who can read their staff directory and how single sign-on groups are named and scoped, and should treat those mappings as sensitive assets.
Investors and enterprise buyers should expect this question in diligence. A breach at an identity provider or a customer's login system can expose staff even when the vendor denies compromise, so vendor statements need independent checking. Reuters, as reported by IBTimes UK, found that some details were already public through LinkedIn profiles, so the main risk is aggregation. Contact details, roles and reporting lines combined in one searchable index make phishing and impersonation far easier.
Key points
- 1Icepick indexes 41,191 DHS personnel records and 55,603 internal permission groups, according to Help Net Security.
- 2WIRED found 39 Homeland Security Investigations employees in groups containing the term CUC, which court records link to undercover operations.
- 3Department of Peace claims it accessed the records through DHS's Okta single sign-on service, and Okta says it has no evidence of compromise.
- 4Reuters matched six named employees to credit bureau and breach data and phoned three of them to confirm details.
