‘Icepick’ Leak Exposes 41,000 DHS Records and Undercover-Unit Clues

Distributed Denial of Secrets has published what it describes as an internal Department of Homeland Security database covering more than 41,000 employees and contractors. DHS told WIRED and Reuters that it was aware of a potential breach and was working to protect its personnel.

The release, called “Icepick,” includes work contact details, offices, assignments and organizational relationships across DHS and seven component agencies, according to DDoSecrets and WIRED. WIRED reported that permission-group names point to undercover operations, wiretap programs, surveillance tools and access to internal systems. Spy Register is not reproducing names, phone numbers or other personal records.

The archive has not been authenticated in full. Reuters said it matched information for six employees against outside records and confirmed details with three of them, but could not verify the entire trove. WIRED said it previewed the material with DDoSecrets and researcher maia arson crimew.

DDoSecrets attributes the data to a group calling itself the Department of Peace and says it came from DHS’s Okta single sign-on service. Reuters could not corroborate that access claim. Okta told WIRED it had no evidence that its systems or data were compromised.

The exposure matters beyond the individual records. WIRED reported that the data reveals reporting lines and permission groups associated with undercover work, communications interception, facial recognition and intelligence functions. Those structures could help an adversary identify personnel, relationships and sensitive responsibilities.

The publishers describe Icepick as an accountability resource. White House border official Tom Homan condemned the release and said the Justice Department was investigating, according to The Washington Post. He argued that publication could raise risks for officers and their families.

What remains unknown is central: who obtained the records, how they were acquired, whether all entries are genuine and current, and what systems were actually accessed. DHS has acknowledged a potential breach, while Okta disputes any evidence that its own platform was compromised.