Hacktivists Leak Work Details of 41,191 Homeland Security Employees and Contractors

A transparency nonprofit has published the names, job titles, office locations and phone numbers of more than 41,000 people who work for or contract with the US Department of Homeland Security. Decrypt reported that the material went online on Wednesday.

The nonprofit, Distributed Denial of Secrets, says the records were passed to it by a politically motivated hacking group. Okta, the identity company whose service the hackers claim to have exploited, says it has found no evidence of a compromise.

What was released

Distributed Denial of Secrets, often shortened to DDoSecrets, specialises in publishing leaked documents. It has named the new dataset Icepick and made it available as a searchable archive.

According to the organisation, the records came from a group calling itself the Department of Peace. DDoSecrets says the group obtained them through an Okta single sign-on service used by DHS. Single sign-on systems let staff reach many internal applications with a single set of credentials, which makes them a valuable target: one entry point can reveal a great deal about an organisation's structure.

The archive indexes 41,191 individuals. Of these, 21,329 are listed as working for Customs and Border Protection. Roughly 10,000 are associated with Immigration and Customs Enforcement (ICE), and about a third of that ICE group sit within Homeland Security Investigations, the department's investigative arm.

For each person, the dataset includes a name, job title, office, email address, phone number and manager. It also lists more than 55,000 internal permission groups, the labels that govern which employees can open which systems. Emma Best, a co-founder of DDoSecrets, has said the material does not include home addresses.

Disputed origins

The question of how the data was obtained remains contested. Okta rejected the suggestion that its platform had been breached, telling Reuters it had found nothing to indicate that its systems or data had been accessed and that its service remained safe.

That leaves several possibilities open. Data visible through a single sign-on dashboard can sometimes be gathered using a legitimate account that has itself been compromised, rather than through a flaw in the provider's own systems. However, the source material does not establish which route, if any, was used, and neither DHS nor the hackers have offered a technical account that has been independently verified.

DHS has acknowledged a problem without confirming the details. A department spokesperson said it was aware of a potential breach and was working to address the situation quickly.

The political motive

The hackers have framed the leak as a response to immigration policy. They say they acted after Homeland Security Secretary Markwayne Mullin promised to intensify ICE operations. A spokesperson for the group pointed to remarks Mr Mullin made on 17 July about increasing pressure, and presented the leak as a direct consequence.

The group also argued that because the government holds data on the public, it was reasonable for the public to hold data on government staff. That reciprocity argument is a familiar one in hacktivist circles, where the line between exposing institutions and exposing the individuals who work for them is frequently blurred.

The department's remit spans border protection, immigration enforcement and cybersecurity. As a result, the leaked file functions as something close to an organisational chart for a large part of the federal security apparatus, showing who holds which role, who reports to whom and how to contact them.

Why it matters

Transparency groups argue that the information has legitimate uses. Knowing which office handles which function, and how to reach the right official, can make public-records requests more effective and help journalists and researchers navigate a sprawling bureaucracy.

Security researchers see a different set of risks. A directory that pairs names with titles, phone numbers and reporting lines is a ready-made toolkit for social engineering. An attacker could use it to impersonate a manager on a phone call, pressure a junior employee into granting access, or identify the people behind sensitive investigations.

The permission-group data may be particularly useful to would-be intruders. Labels showing which teams have access to which systems can help an attacker work out whose account would be most valuable to compromise. Even without passwords, such mapping reduces the guesswork involved in planning a targeted intrusion.

The absence of home addresses limits some of the most immediate physical-safety concerns, but names and job titles can often be combined with other publicly available information. For staff working in immigration enforcement, an area of intense political conflict, that possibility is likely to be a source of anxiety.

Government response and limits of the leak

DHS has moved to restrict the spread of the data. Working with the security company ZeroFox, it submitted a removal request urging the domain registrar to cease publishing the contact and whereabouts information of individuals who had not consented to its release.

The search site built on the dataset stopped loading on Thursday, and its domain showed a registrar hold. Bluesky, the social media platform, has been blocking links to the nonprofit hosting the archive.

Such measures can slow distribution but rarely eliminate it. Once a dataset has been published and copied, it tends to resurface on other hosts, which is why organisations affected by leaks often focus as much on mitigating the consequences as on removing the material.

There are also signs that the data is ageing. The most recent records date to 19 August, and some entries are already stale, including staff at the Cybersecurity and Infrastructure Security Agency (CISA) who have since left. Personnel directories lose accuracy over time as people change roles, which could reduce the leak's usefulness for both transparency work and malicious targeting.

A pattern of exposure

The incident follows other recent episodes involving federal law enforcement personnel. In September, the cybercrime group ShinyHunters claimed to hold between 2 and 3 terabytes of data relating to FBI agents and job applicants. The bureau responded by telling staff to assume that hackers had their personal information.

The two cases differ in important respects. ShinyHunters is described as a cybercrime group, whereas the Department of Peace presents itself as politically driven. But both point to the same underlying vulnerability: data about the people who staff security agencies is itself a target, and its exposure can create risks long after the initial leak.

What to watch

Several questions remain unresolved as DHS assesses the incident:

• Whether investigators establish how the data was obtained, and whether Okta's systems or a compromised DHS account were involved
• Whether the archive reappears on other domains despite the takedown efforts
• What guidance DHS gives affected staff on phishing and impersonation attempts
• Whether the Department of Peace releases further material

The answers will shape whether this is remembered as a contained embarrassment or as the starting point for more targeted attacks on federal personnel.