Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace.
The group handed the data to the transparency collective Distributed Denial of Secrets (DDoSecrets) and to Swiss hacker and journalist maia arson crimew. DDoSecrets published the dataset, named Icepick, on October 28. According to the hacktivists, the records were taken from an Okta single sign-on service used by DHS.
Okta disputes that its systems were breached. “Okta is secure, and we have no evidence our data or systems were compromised,” the company told Reuters.
Reuters matched personal information about six DHS employees named in the leak to credit bureau records and breach data, and confirmed phone numbers and other details by calling three of them directly. One said it was the first they had heard of a breach.
In a statement shared with the BBC, a DHS spokesperson said the department is “aware of a potential breach and is actively working to address the situation swiftly and effectively.” “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected,” DHS added, noting that it will update the public when more information is available.
The Icepick leak is the third major blow to U.S. federal agencies in about a month. In late September, the ShinyHunters extortion group claimed it stole personal information of FBI employees and job applicants, including medical records, after breaching the bureau’s job portals.
Days later, the Pentagon’s Defense Manpower Data Center began notifying more than 3 million people that unauthorized users had accessed their personal data, including Social Security numbers, through a vulnerable file sharing system.
A searchable directory of DHS staff
Crimew built an online tool at icepi.cx that makes the data easier to browse and cleans and enriches the raw records, with help from her longtime co-researcher, journalist Ryan Fae.
The site indexes 41,191 people and 55,603 internal groups, along with offices and locations. Customs and Border Protection staff make up the largest share with 21,329 entries, while ICE accounts for 6,598.
The operators of the tool say the data was enriched through automated and manual research, that the list does not include every DHS employee, and that inaccuracies in the source data may be reproduced. CISA employees are left out of searches by default to keep the focus on the department’s law enforcement and intelligence arms.
Undercover units and use of force instructors
The internal group records go beyond job titles. Searches suggested on the site turn up groups containing operation names, groups tied to Homeland Security Investigations (HSI) certified undercover agents, and groups that appear to grant staff access to digital forensics and data analysis tools.
Another search lists people inside ICE who appear to be use of force instructors, some of whom, the site says, were involved in ICE shootings. Users can also look up ICE and HSI staff by city.
Leakers cite political motive
A Department of Peace spokesperson said the leak is what happens to ICE when someone turns up the heat, a reference to a July 17 remark by DHS Secretary Markwayne Mullin.
Crimew called the dataset massive in both size and impact. “It is a complete game changer for anyone investigating DHS,” she said, explaining that the data shows who does which work in several DHS agencies, including ICE, makes it simpler to identify agents and their lines of command, and will supply Freedom of Information Act (FOIA) material for years.
DDoSecrets co-founder Emma Best said Icepick identifies the people who design and drive DHS policy and operations. The leak, she noted, names officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation, along with key personnel in DHS rendition and deportation programs.
Dr. Ryan Shapiro, executive director of Property of the People, argued that email addresses and phone numbers often decide whether a records request gets stonewalled or gets results, and that the Trump administration’s contempt for basic transparency makes such tools urgent.
The hacker behind the search tool
Crimew, a hacker from Lucerne previously known as Tillie Kottmann, was behind the 2021 Verkada surveillance camera breach.
Charged in the U.S. with computer fraud and identity theft in March 2021, she remains in Switzerland, which does not extradite its own citizens unless they agree to it.
In 2023 she obtained a copy of the U.S. No Fly List, the secret government list of people banned from commercial flights in or over the United States, after finding it on an unsecured airline server.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
