Distributed Denial of Secrets published an archive covering more than 41,000 Homeland Security Workers on Wednesday, October 28, 2026, listing employees and contractors across the Department of Homeland Security and seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection.
Background: Hackers Dox Hundreds of Trump’s Masked ICE Agents and DHS Officials
The transparency nonprofit named the collection “Icepick.” Records show the archive was last updated on August 19, 2026.
The files contain names, job titles, email addresses, cellphone numbers, office addresses and locations. They also link staff to internal systems and permission groups.
Some records expose details about undercover ICE Agents. The archive also lists locations of ICE and CBP facilities, along with groups tied to wiretap programs, Palantir software and xAI’s Grok chatbot.
Those links reveal more than a directory. The records identify assignments involving surveillance, computer forensics, special operations and undercover work.
CBP accounts for the largest share of the records
| Agency or unit | Records described |
|---|---|
| Customs and Border Protection | About 21,000 |
| Immigration and Customs Enforcement | About 10,000, roughly one-third in HSI |
| U.S. Citizenship and Immigration Services | 6,200 |
| Cybersecurity and Infrastructure Security Agency | Nearly 1,000, more than half contractors |
CBP personnel make up more than half the archive, with staff working at airports and other ports of entry. Thousands of additional entries concern headquarters and other components, including the Federal Protective Service.
DDoSecrets says the records cover about a seventh of the department’s workforce. Workforce comparisons use different totals: one estimate puts DHS at around 220,000 staff, while another counts more than 26,000 directly employed staff and describes the archive as roughly fifteen percent of that group.
Access-group labels identify undercover and surveillance work
A WIRED analysis of the records identified 39 HSI employees across more than a dozen field offices in groups whose names include “CUC.” Government court filings say the initials stand for “certified undercover operation.”
Another group, apparently linked to HSI’s St. Paul, Minnesota, area of operations, references “Keyhole.” Federal court filings also describe Keyhole as a certified undercover operation.
The data connects agents to particular assignments and reporting lines. A sample record for David Easterwood, an ICE deputy field office director working in Minnesota, lists group memberships including “ERO St Paul Intelligence Team” and “Adobe-Acrobat Pro DC Users.”
Its “Manager” field can trace a person upward through the chain of command. “Manager of” can identify people reporting to that employee.
The claimed Okta route remains unconfirmed
DDoSecrets says the material came from DHS’s Okta login system. Emma Best, a journalist and DDoSecrets co-founder, said the Department of Peace harvested it from “the Okta sign-on service” and provided copies to the nonprofit and maia arson crimew.
That account of how the records were obtained remains an attributed claim. Okta said it had no evidence of a compromise. A spokesperson said:
“Okta is secure, and we have no evidence our data or systems were compromised.”
The login platform allows DHS employees and contractors to access a central network. Its account records also show which internal systems and applications a user can access.
The directory timestamps indicate that records may have been taken around mid-August. Checks matched personal information for six DHS employees to credit bureau records and breach data carried by District 4 Labs. Calls to three employees confirmed their phone numbers and other details; one said it was the first they had heard of a breach.
Some entries match information on employees’ LinkedIn profiles. Others reveal nonpublic organizational-chart details or previously undisclosed programs and operations. The full trove has not been independently authenticated.
A searchable site links employees to groups and managers
Crimew built a searchable website for the records at Icepi.cx. DDoSecrets said crimew cleaned and enriched the raw files with help from longtime co-researcher and journalist Ryan Fae.
The tool lets users search associated groups, follow management chains and inspect details about an employee’s command. Crimew said:
“I don't think we should let them scare us into not looking into them”
Best said the archive could support reporting, congressional inquiries, legal challenges, community action and Freedom of Information Act requests. She said the release and search tool would “replace anonymity with accountability.”
Dr. Ryan Shapiro, executive director of Property of the People, said email addresses and phone numbers help FOIA researchers make more targeted requests. He said those details can distinguish a vague request that gets stonewalled from one that gets results, and called the need urgent given what he described as the Trump administration’s contempt for basic transparency.
The release drew a political response as agencies stayed silent
The hackers presented the disclosure as a response to government surveillance. A note included with the records said: “They have our information, so it's only fair that we have theirs.” The Department of Peace said it hoped the files “can be used to limit further harm by the DHS and supports all efforts in that direction.”
A spokesperson for the group tied the release to Markwayne Mullin’s remarks: “On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that”. In March, the group claimed responsibility for hacking DHS and posting documents related to contracts with outside vendors.
DHS and the Justice Department did not respond to requests for comment. The FBI referred inquiries to DHS. The Department of Peace did not respond to requests for comment or questions about how the files were obtained.
The records do not establish whether the vulnerability has been fixed or whether the department knows the data was taken.
