A hacker published work contact information and tool access records for tens of thousands of federal personnel, including border and immigration agents.
The U.S. Department of Homeland Security is investigating a cybersecurity breach after a hacker leaked directory records and contact details belonging to tens of thousands of federal personnel, Fox News reported. The compromised dataset contains names, job titles, office locations, email addresses, and phone numbers for federal workers and contractors across multiple agencies, including border control and immigration authorities.
What the leaked files reveal
According to sources cited by Fox News, the incident affected roughly 40,000 staff members, while TechCrunch reported that the files contain records for more than 40,000 people. The Verge cited reporting placing the total above 41,000 employees. The leaked data represents approximately one-fifth of the department’s 220,000-person workforce, with timestamps indicating the information was copied around mid-August.
More than half of the records involve U.S. Customs and Border Protection staff, covering some 21,000 employees who work at airports and border crossings, though Fox News described the CBP figure as exceeding 20,000. Outlets also reported differing totals for U.S. Immigration and Customs Enforcement personnel. TechCrunch and Fox News reported that around 10,000 ICE records were exposed, including personnel in Homeland Security Investigations, while The Verge reported nearly 7,000 ICE records. Fox News confirmed that the breach revealed the identities of several undercover ICE agents working across the country.
The files also hold records for nearly 1,000 staff at the Cybersecurity and Infrastructure Security Agency, as well as personnel at department headquarters, the Federal Protective Service, and U.S. Citizenship and Immigration Services. Beyond personal contact details, the leak exposes internal Active Directory groups showing permissions for third-party tools. These include access lists for web surveillance service Penlink, facial recognition application Mobile Fortify, ChatGPT, and accounts linked to investigations into Chinese hacking groups Salt Typhoon and Volt Typhoon. Around 4,500 users were listed in a group for the mental health platform Headspace, though a Headspace spokesperson said its contract ended in 2023 and it no longer provides services to the department.
Why the breach matters
A hacker or collective using the name Department of Peace took credit for the intrusion. The actor claimed to have obtained the material through Okta, an identity management platform used by Homeland Security for central system access. A note left with the data stated, ‘They have our information, so it’s only fair that we have theirs.’ Fox News described the hacker as an anti-fascist group that declared it wanted the material used to limit harm by the department.
The leaked dataset, dubbed Icepick, was passed to hacker and researcher maia arson crimew before being shared with Distributed Denial of Secrets, a nonprofit that publishes leaked records. DDoSecrets published the material and created a search tool to let the public review the information. Co-founder Emma Best said the tool aims to replace anonymity with accountability and could aid congressional inquiries, legal cases, and records requests. Transparency researchers, including Ryan Shapiro of the nonprofit Property of the People, noted that verified email addresses and phone numbers give researchers concrete leads when filing Freedom of Information Act requests.
Preceding security breaches
The incident follows several other government cybersecurity failures earlier this year. The same hacker previously claimed responsibility for obtaining thousands of contracts between Homeland Security and private vendors, including surveillance suppliers and defense contractors.
Other federal departments have dealt with parallel intrusions. A recent breach of a Pentagon personnel database compromised personal data belonging to 2.76 million living military and civilian workers, along with 294,000 deceased individuals, between October 2025 and July 2026. Hackers also recently stole personnel files and applicant information from the FBI.
What happens next
Homeland Security officials said they are responding to the incident. A department spokesperson stated that the agency is actively working to address the breach swiftly and will ensure personnel are protected, adding that the public will receive updates as more information emerges.
Okta disputed that its own infrastructure was breached. ‘Okta is secure, and we have no evidence our data or systems were compromised,’ an Okta spokesperson said. Department officials haven’t confirmed whether the vulnerability used to pull the data has been identified or closed.
