Hacker Leaks Work Details of More Than 40,000 Homeland Security Employees
The Despoiler counted the published records: Texas has the most, Ohio has 195, and more than half belong to Customs and Border Protection. No names are published here.
A hacker using the name "Department of Peace" has published work records for more than 40,000 Department of Homeland Security employees, about a fifth of the department's workforce, TechCrunch reported Wednesday, Oct. 28. The records include names, job titles, work email addresses, work cell phone numbers and office locations.
TechCrunch said it checked several names of known DHS employees against a copy of the data and found it appeared authentic. Timestamps in the records suggest they were taken around mid-August.
How it came out
The hacker says the data came from Okta, the single sign-on service DHS employees use to log in to work systems. Besides contact details, the records show which internal systems and apps each person could use, TechCrunch reported. The BBC reported that the data also names dozens of previously unknown operations, the agents who led them, and technology used, including products from Cellebrite and Palantir.
The hacker gave the data to hacker and journalist maia arson crimew, who shared it with Distributed Denial of Secrets, a nonprofit that publishes leaked datasets. The collection is being called "Icepick."
"They have our information, so it's only fair that we have theirs," the hacker wrote, according to TechCrunch. DDoSecrets co-founder Emma Best told the BBC the goal was to replace "anonymity with accountability."
What The Despoiler found in the numbers
The Despoiler reviewed a copy of the published data and counted it. We looked only at totals: how many records fall under each agency and work location, which first and last names are most common, and how many accounts had access to certain apps. We are not publishing any person's name, phone number or office.
Our count found 41,191 records. That matches the "more than 40,000" figure TechCrunch reported. Two caveats matter for everything below. First, the location in each record is a work location, not a home address. Second, this is a login directory, not a personnel roster: about 11,600 accounts were listed as set up but never activated, so some records may belong to people who have left, never started, or are contractors.
Most of the people in the data are not deportation officers. Customs and Border Protection alone accounts for more than half. Citizenship and Immigration Services, the agency that processes green cards and naturalization, has more than 6,000 records, and smaller groups include cybersecurity staff, building guards and trainers.
Texas leads by a wide margin, with 7,623 records, including the most ICE records of any state (1,368). About 1,500 records list no state.
Ohio's share
Ohio ranks 28th, with 195 records. That's about half of 1 percent of the leak.
The Ohio records cluster around the state's known federal immigration offices. ICE's deportation arm in Ohio answers to its Detroit field office and has sub-offices in Brooklyn Heights near Cleveland, Westerville near Columbus and Blue Ash near Cincinnati, according to an Ohio Immigrant Alliance report. Port Clinton is home to Border Patrol's Sandusky Bay Station, which covers western and central Lake Erie and five shoreline counties, according to CBP. Middleburg Heights sits next to Cleveland Hopkins International Airport.
The federal government has never said how many ICE officers work in Ohio. The Columbus Dispatch and USA Today reported in May that ICE was adding 10 positions in Ohio, five each in Westerville and Brooklyn Heights, but that it was unclear how many people already worked there. The leak doesn't settle that either, since it covers only part of DHS. It does give a floor.
Who's in it, by name
The most common first name in the data is Michael, with 832 records. The most common surname is Garcia, with 276. The surname list largely tracks the country's: Garcia, Rodriguez and Martinez are also in the Census Bureau's 2010 top 10, and Smith, Johnson and Brown round out the list. The large number of Spanish surnames also reflects a workforce concentrated in Texas, California and Arizona.
What the accounts could open
Each record lists the account groups the person belonged to, which control what apps and systems they could use. Most are routine, like mobile email. A few show the tools of the job:
- TAK (Team Awareness Kit): a map-sharing app first built for the military that lets teams in the field see each other's positions. About 6,250 records were in a Border Patrol TAK group.
- Immigration court access: about 6,350 records had access to a system of the Executive Office for Immigration Review, the Justice Department office that runs the immigration courts.
- Axon: the company best known for Tasers and police body cameras. About 4,470 records were in a Border Patrol group for an Axon video app.
- PenLink: a company whose software helps police collect and analyze phone and online data. About 2,240 records, almost all in Homeland Security Investigations, were in a PenLink group. TechCrunch reported that PenLink has a contract with ICE; the company didn't respond to TechCrunch.
- Headspace: about 4,550 records, many of them ICE deportation staff, were in a group named for the meditation app. Headspace told TechCrunch it hasn't provided services to DHS or ICE since 2023.
What DHS and Okta say
DHS did not immediately respond to TechCrunch or the BBC. It isn't clear whether the department knew about the theft or has closed the hole. Okta said, "Okta is secure, and we have no evidence our data or systems were compromised."
Why it matters
The leak lands in the middle of a fight over whether immigration agents should be identifiable at all. Agents often work with their faces covered and rarely identify themselves, the BBC noted, and lawmakers have pressed DHS to enforce identification rules. Supporters of the leak say the records will feed public-records requests and investigations. Critics say publishing workers' names and phone numbers puts people at risk, including the thousands who process paperwork, guard buildings or defend government networks.
It is also the latest in a string of government breaches. The BBC said the FBI was hacked last month and the Federal Election Commission was knocked offline during a suspected attack. TechCrunch reported that the same hacker claimed in March to have taken DHS contract data.
How we did this: The Despoiler counted the published records with a script that output only totals. No names, phone numbers, email addresses or individual work addresses are published, and only names shared by more than 100 records appear in the charts. Charts count records by the work location listed in each record. If you work for DHS and want to tell us something about this data, our tip line is on the About page.