40,000 DHS workers' data leaked online

Data on 40,000+ DHS workers, including CBP and ICE staff, has been leaked online, per reports.

According to TechCrunch and Wired, the records include names, job titles, email addresses, phone numbers and office locations or addresses. Wired counts more than 41,000 employees or contractors across DHS and seven component agencies. TechCrunch says CBP accounts for about 21,000 records, ICE and HSI about 10,000, and CISA just under 1,000.

Both outlets report the data was provided to journalist and hacker maia arson crimew, who shared it with the nonprofit DDoSecrets. DDoSecrets published the archive, which it calls "Icepick". TechCrunch says it verified part of the data against an offline copy of the database and that it appears authentic. A hacker using the handle Department of Peace claimed it came from an Okta single sign-on system DHS uses. Okta said it has no evidence its data or systems were compromised.

Wired reports the data includes permission-group names referencing tools such as Penlink and the Mobile Fortify facial-recognition app. Open questions: how the breach was carried out, whether the vulnerability is fixed, and whether DHS is aware. The hacker did not respond to TechCrunch, and DHS did not immediately respond.

The facts we checked

According to TechCrunch and Wired

1. Personal data on more than 40,000 people who work for the U.S. Department of Homeland Security has been published online.Figure · TechCrunch
2. The leak exposes details of more than 41,000 DHS employees or contractors across DHS and seven component agencies.Figure · Wired
3. The records include names, job titles, email addresses, phone numbers and office locations or addresses.Fact · TechCrunch and Wired
4. A hacker using the handle Department of Peace claimed the data came from an Okta single sign-on system DHS uses for employee and contractor logins.Alleged · TechCrunch
5. CBP accounts for more than half of the records, about 21,000. ICE and its HSI unit account for about 10,000, and CISA for just under 1,000.Reported · TechCrunch and Wired
6. The data was provided to journalist and hacker maia arson crimew, who shared it with the nonprofit DDoSecrets. DDoSecrets published the archive, which it calls "Icepick".Reported · TechCrunch and Wired
7. TechCrunch verified part of the data by matching names of known DHS employees against an offline copy of the database, and said the data appears authentic.Reported · TechCrunch
8. Records appear to have been taken around mid-August according to timestamps (TechCrunch); the data was last updated August 19, 2026 (Wired).Reported · TechCrunch and Wired
9. The leaked data includes permission-group names that reference tools such as Penlink and the Mobile Fortify facial-recognition app, and more than 200 CBP users are in a Mobile Fortify group.Reported · TechCrunch and Wired
10. Wired reports that 39 HSI employees belong to groups whose names include "CUC", which court filings say stands for "certified undercover operation".Reported · Wired
11. "They have our information, so it's only fair that we have theirs." This was the note left with the data, attributed to the hacker.Quote · TechCrunch and Wired
12. Okta said: "Okta is secure, and we have no evidence our data or systems were compromised."Quote · TechCrunch and Wired
13. The hacker did not respond to TechCrunch's questions about how the breach was carried out. DHS did not immediately respond to TechCrunch, and DHS and DOJ did not respond to Wired. TechCrunch says it is unclear whether the vulnerability has been fixed or whether DHS is aware of the theft.Reported · TechCrunch and Wired
14. "If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," said Alexander Leslie of Recorded Future.Quote · Wired

Sources

• TechCrunchHacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
• WiredMassive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents