Skip to content
Sign in
Technology · North America

Department of Peace hacker exposes data on more than 40,000 Homeland Security employees

A hacker using the handle Department of Peace published personal records concerning more than 40,000 Department of Homeland Security employees and contractors online. The records include contact details and office locations, and the hacker claimed to have obtained them through DHS’s Okta login system.

AI-assisted synthesis · Based on 6 independent reports from 7 outlets · Article text read from 4 of 6 reports · 2 articles captured only in partHow it's made

View timeline · 6 entries
7 outlets3 regionsLatest reporting 3 min read
Coverage: Mostly CenterL 0 · C 5 · R 1 · 1 unrated

What happened

Key facts

  • The searchable database, called “Icepick,” published work details for more than 41,000 DHS employees and contractors.
  • The report said more than 21,000 listed personnel work for CBP and nearly 6,600 are associated with ICE.
  • The records also reportedly included personnel from Homeland Security Investigations, the Federal Protective Service and the Cybersecurity and Infrastructure Security Agency.
  • The hacker claimed to have taken the data from an Okta single sign-on system used by DHS employees and contractors.
  • The exposed details included names, work addresses, phone numbers and job descriptions.
  • The exposed information included names, titles, email addresses, mobile phone numbers and office locations.

The brief

A hacker using the handle Department of Peace published records concerning more than 40,000 Department of Homeland Security employees and contractors, exposing personal and work-contact information. The hacker claimed the data came from the department’s Okta login system; DDoSecrets also said the archive came from that system.

The records include names, job titles, email addresses, phone numbers and office locations. The affected workforce spans border and immigration personnel, cybersecurity staff and senior department officials. About 21,000 entries concern U.S. Customs and Border Protection employees.

The figures reported for other agencies do not align: DigitalToday reported about 10,000 records concerning U.S. Immigration and Customs Enforcement and its Homeland Security Investigations unit, while The Verge reported nearly 7,000 for ICE staff. DigitalToday also identified about 1,000 Cybersecurity and Infrastructure Security Agency entries.

The coverage describes the scale somewhat differently. TechCrunch reported more than 40,000 Department of Homeland Security employees, while Wired described an archive covering more than 41,000 employees or contractors. The Verge likewise reported more than 41,000 records.

These accounts agree that the leak was extensive, but the reported totals vary between roughly 40,000 and more than 41,000. The data’s route remains a claim rather than an independently established account in the supplied reporting: the hacker attributed it to Okta, and DDoSecrets said the material came from the department’s Okta login system.

TechCrunch reported that record timestamps point to extraction around mid-August. The Verge described the records as linked to surveillance tools, while Wired specified records involving ICE and CBP facility locations and workers associated with wiretap programs, Palantir software and xAI’s Grok chatbot.

The hacker’s note framed publication as a matter of fairness, saying, “They have our information, so it’s only fair that we have theirs.” That statement gives the hacker’s stated rationale, not independent evidence about why the records were obtained or published.

TechCrunch also quoted Ryan Shapiro, executive director of Property of the People, who argued that employee contact details can help researchers make public-records requests more effective.

Wired reported that Adam Steinbaugh, a senior attorney at the civil liberties group FIRE, said the Trump administration has taken an expansive view of a federal law barring disclosure of restricted personal information about federal officers or their families when intended to threaten them.

That legal observation concerns the wider risks around publishing personnel information; it does not establish that the hacker’s conduct violated the law. The reporting describes a large release of identifiable contact and location data, while the precise total and some agency-level counts differ across accounts.

Why it matters

  • Department of Homeland Security employees and contractors bear the direct exposure: the records reportedly include personal contact details and office locations for more than 40,000 people.
  • Border and immigration personnel face exposure within a dataset that includes about 21,000 U.S. Customs and Border Protection records; DigitalToday also reported about 10,000 ICE and Homeland Security Investigations records.
  • Cybersecurity personnel are among those affected: DigitalToday reported about 1,000 Cybersecurity and Infrastructure Security Agency records.
  • The reported links to ICE and CBP facilities and to wiretap programs, Palantir software and xAI’s Grok chatbot make the information more operationally sensitive than a contact directory alone.

What to watch next

  • Whether the Department of Homeland Security publicly addresses the reported exposure.
  • Whether Okta comments on the claim that the records came from its login system.
  • Whether DDoSecrets or the hacker provides further information about the archive’s origin or scope.
  • Whether subsequent reporting reconciles the different ICE counts: about 10,000 records for ICE and Homeland Security Investigations in DigitalToday’s account versus nearly 7,000 ICE records in The Verge’s.

How it's being covered

Coverage analysisShow details
7 source articles · 7 unique outlets · 6 distinct reports
Outlet political mix: Mostly Center· 5 Center · 1 Right · 1 unrated
Where the outlets are based: US/Canada 57% · Asia 29% · Other 14%
Outlet political mix
Mostly Center
Left
Center
Right
0 outlets
5 outlets
1 outlet
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
7 unique outletsDominant coverage: US/Canada
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (5 of 6 rated sources); comparatively few Left-rated outlets have published on the event.
How we measure coverage

How outlets' accounts compare

1 factual disagreement · 4 framing differences · 2 uncorroborated claims · 2 information gaps
Sources disagree on one factual point.Compared across 4 reports whose article text Updat3 read; 2 other outlets were checked by headline only.
Factual disagreements
Sources report different numbers, dates, attribution or causes for the same thing.
  • DigitalToday reports about 10,000 records for ICE and Homeland Security Investigations, while The Verge reports nearly 7,000 for ICE.
Updat3: The evidence conflicts; Updat3 does not present either version as established.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • TechCrunch emphasizes the hacker’s claimed Okta access and the scale of the employee-directory release; Wired describes an archive of more than 41,000 employees or contractors and highlights records connected to facilities and surveillance-related tools.
  • The Verge focuses on personal records and links to surveillance tools, while DigitalToday gives agency-level counts for CBP, ICE and CISA.
  • TechCrunch reports more than 40,000 employees; Wired and The Verge report more than 41,000 employees or contractors.
  • The hacker attributes the records to DHS’s Okta login system; DDoSecrets also says the data came from that system.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • The hacker’s note says, “They have our information, so it’s only fair that we have theirs.”
  • Ryan Shapiro said employee email addresses and phone numbers can help researchers make public-records requests more effective.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The reporting does not establish whether any affected employees experienced threats, harassment or other harm.
  • The records’ origin in the Okta system is attributed to the hacker and DDoSecrets; the reports do not independently establish that account.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. DHS was established by the Homeland Security Act of 2002, signed Nov. 25, 2002.
    Background · from our historical context
  2. Immigration and Customs Enforcement and Customs and Border Protection began operating in 2003 as parts of the new department.
    Background · from our historical context
  3. Okta, founded in 2009, built cloud-based identity services that allow organizations to manage user access through single sign-on.
    Background · from our historical context
  4. Congress established the Cybersecurity and Infrastructure Security Agency within the Department of Homeland Security.
    Background · compiled and fact-checked by Updat3
  5. Executive Order 14028, signed by President Joe Biden on May 12, 2021, directed US agencies to modernize cybersecurity and adopt stronger identity and access controls.
    Background · from our historical context
  6. Okta disclosed that an attacker had accessed files in its customer-support system.
    Background · compiled and fact-checked by Updat3

How we got here

On Oct. 20, 2023, Okta disclosed that an attacker had accessed files in its customer-support system; the company later said the intrusion ran from Sept. 28 to Oct. 17. That incident established a documented precedent for risks involving identity-provider systems, though it did not involve the DHS records described in the current report.

Executive Order 14028, signed by President Joe Biden on May 12, 2021, directed US agencies to modernize cybersecurity and adopt stronger identity and access controls. The Cybersecurity and Infrastructure Security Agency, created in 2018, issued its Zero Trust Maturity Model in June 2021 to guide that shift. DHS was established by the Homeland Security Act of 2002, signed Nov.

Original sources

1 of 7 articles · Europe · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.