DHS data leak: what the 41,000-name Icepick files really expose

The files hold work contact details and job information, not Social Security numbers or bank records. Entries include names, job titles, work email addresses, phone numbers and office addresses, along with each person’s membership in internal permission groups, the lists that decide who can open which system.

The scale is large. The records cover DHS itself plus seven agencies inside it, which works out to about one in every seven people in the department’s workforce. One analysis of the data broke it down like this:

• Customs and Border Protection staff make up more than half of the records.
• Immigration and Customs Enforcement accounts for about 10,000, with roughly a third of those in Homeland Security Investigations, ICE’s investigative arm.
• US Citizenship and Immigration Services has about 6,200 entries.
• The Cybersecurity and Infrastructure Security Agency (CISA) has nearly 1,000, more than half of them contractors.

The data was last updated on August 19, 2026, but parts are clearly older. Some group names refer to COVID-19 planning and internal summits from 2023, and reporters found CISA staff listed who left the agency years ago.

The contact details are the least sensitive part. The bigger problem is the map of more than 55,000 permission groups, because group names describe what people do.

Thirty-nine Homeland Security Investigations employees in more than a dozen field offices sit in groups labeled “CUC”, which government court filings say means certified undercover operation. Other groups reference a wiretap program, a communications intercept unit and tools for pulling data from seized phones, analyzing phone records and searching immigration court files. Some point to commercial products such as Palantir’s Falcon platform and PenLink.

Even the AI policy shows up. Groups reference ChatGPT, Gemini and Copilot, and two groups appear to list the same 13 senior people who are exempt from the department’s web filter.

A national security expert at the threat intelligence firm Recorded Future warned that, if the data is real and current, it is extremely valuable to anyone trying to break into DHS, and becomes more useful still when combined with older leaks and commercial data. In plain terms, knowing exactly who runs a surveillance program and how to reach them makes a convincing fake email or phone call far easier to pull off.

That is the open question. The Department of Peace says it pulled the database from the Okta single sign-on service DHS uses. Single sign-on lets a worker log in once and reach many workplace apps, which is convenient but means one stolen account can open a lot of doors.

Okta disputes any breach on its side. A company spokesperson said Okta is secure and has no evidence its data or systems were compromised. Both can be partly true: a customer’s own Okta setup can be misused through stolen employee credentials without Okta’s platform itself being hacked. Neither DHS nor Okta has said how the data actually left.

The group says the attack was a response to DHS Secretary Markwayne Mullin’s July 17 pledge to step up immigration enforcement. It previously claimed a DHS hack involving contractor records in March.

Bluesky now stops users from opening links to the archive and the search site, showing a “Blocked Link” page that calls the address malicious. The company says the files share people’s contact details without their permission, against its rules, and that blocking links rather than deleting posts keeps public discussion open.

Not every app follows along. Because Bluesky runs on an open protocol, at least one third-party app opens the links with no warning. On X, the Grok chatbot pointed curious users to the search site and said where the full dataset can be downloaded. DDoSecrets says platforms have tried to block it before: Twitter suspended its account in 2020 after the group published BlueLeaks, a 269-gigabyte cache of police records.

If you don’t work for DHS or one of its contractors, your own data isn’t in this archive. The practical lessons still apply to anyone with a work login:

• Expect targeted phishing. Leaked job titles and team names are the raw material for believable fake messages. Treat any unexpected request that mentions your team or a colleague by name with extra suspicion.
• Guard your single sign-on account. If one password opens all your work apps, use a hardware key or an authenticator app, never text codes alone, and report odd login prompts.
• Verify before you act. Call back on a number you already know before sharing documents or approving access.

DHS has a history here. A 2014 breach may have exposed data on 390,000 current and former employees, applicants and contractors, and in 2018 the department notified nearly 250,000 people of another breach. This year has also brought leaks of FBI employee records and a Defense Manpower Data Center breach affecting roughly 3 million people.