A Department of Homeland Security breach by an activist group has exposed the personal information of more than 41,000 employees, including Customs and Border Protection workers, Immigration and Customs Enforcement officers and others who work in government cybersecurity.
Information collected from the breach was published online in a searchable repository called Icepick on the Distributed Denial of Secrets website. According to the news leaks site, a hacktivist group called the Department of Peace breached an Okta single sign-on service used by the DHS, stealing employees’ names, contact information and assignments. The group then distributed copies of the database through the leak-hosting group DDoSecrets and to a self-described investigative journalist and cybersecurity researcher from Switzerland known as maia arson crimew, who created an online tool to search the data.
The hacktivist crimew described the leak as an “unprecedented” and “massive” exposure of the DHS’s internal structure. By detailing exact roles, chains of command and agent identities across agencies like ICE, the dataset is a “complete game changer” that leaves the department highly vulnerable to outside investigation for years to come.
The breach appears to be the latest retaliation against government-led surveillance, including ICE’s increasingly tech-driven enforcement tactics and private partnerships with companies such as Flock Security. The Department of Peace directly cited DHS Secretary Markwayne Mullin’s July statement about “turning up the heat on the streets” — a reference to ramping up the immigration crackdown and arrests — and responded, “This is what happens to ICE when you do that.” The hackers also attached a note to the files reading, “They have our information, so it’s only fair that we have theirs.”
A DHS spokesperson told CNET that the agency “is aware of a potential breach and is actively working to address the situation swiftly and effectively.” The statement went on to say: “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected.”
A massive leak of information
Since the leak, the DHS has been working to take down sites hosting the information, including Icepick’s searchable archive domain. The social network Bluesky opted to block links to DDoSecrets, telling TechCrunch that the platform’s community guidelines prohibit “the unauthorized sharing of personal information and other content that could pose safety risks.”
Much of the attention on the Icepick leak has focused on its size. While the 41,000 affected employees represent only a fraction of the nearly quarter-million people at the DHS, the data goes far beyond basic contact information. Reports indicate the leak exposes office addresses and phone numbers, as well as details on internal work systems and the department’s inner workings.
Because the hackers gained access through Okta, a secure portal for employee login, they also saw the master list of apps connected to that dashboard. That revealed an inventory of surveillance applications used by ICE, including specialized wiretapping and surveillance software, such as Penlink, and popular AI applications like ChatGPT and Gemini, raising questions about how federal agencies feed case files or border data into commercial AI models.
While cross-referencing Icepick data could expose undercover operations, it also risks including unrelated personnel, such as airport security workers. However, DDoSecrets cofounder and journalist Emma Best argued the release is strategic rather than an indiscriminate dump. “Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations,” Best wrote.
Retaliation against federal agencies
The public response to the breach also points to a crisis of institutional legitimacy, with many viewing the exposure not as a crime but as forced transparency against a federal department that has acted with impunity. In a Facebook comment thread accompanying an NPR story about the incident, many responded with support for the hacktivists: “Not all heroes wear capes,” one commenter wrote, while another said, “Law enforcement identities must be public. Otherwise, it’s just a gang.”
When an agency known for aggressive enforcement and widespread surveillance gets breached, a segment of the population sees it as poetic justice.
There’s also been an escalating operational crisis for any tech company that signs a contract with ICE or DHS agencies. From the outside, hacktivists are targeting their infrastructure (like this recent breach) to unmask federal agents and leak their surveillance toolkits. And from the inside, employees are sounding the alarm, demanding that leadership cancel contracts on moral grounds.
That was the case recently with the robot company Boston Dynamics, after it was reported that ICE planned to spend up to $2 million on Spot robots made by the company. Hundreds of employees signed a petition saying that they can’t be proud working for Boston Dynamics “when that work is being used by a government agency that brutalizes civilians.” The employee noted that friends and family are asking them “in disbelief and horror” how they can work on ICE robots, an indication of broader distrust.
The recent massive DHS breach isn’t a random, isolated cyberattack. Earlier this year, the Electronic Frontier Foundation detailed the spread of “enterprising hackers [that] have started projects to do counter surveillance against ICE,” including applications and web tools geared toward tracking officers’ movements and countering Flock surveillance cameras that can read license plates.
“It’s important to remember that we are not powerless,” wrote EFF’s Senior Staff Technologist Cooper Quintin. “Even in the face of a domestic law enforcement presence with massive surveillance capabilities and military-esque technologies, there are still ways to engage in surveillance self-defense.”
Read the full article here
