The DHS data leak published on 28 October 2026 exposed work records for more than 41,000 current and former United States Department of Homeland Security (DHS) employees and contractors, according to news coverage of the disclosure. The archive, called Icepick, was published by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) after it said it received the records from a group calling itself the Department of Peace. It is not a routine staff directory. Alongside names and work contact details, the records included job titles, office locations, supervisors in some entries, and more than 55,000 internal group names showing which internal systems and tools each person could access. That combination is why the DHS data leak travelled beyond cybersecurity reporting: a list of who works where, combined with a map of what they can access, can reveal how a department is organised and where its sensitive work sits.
This explainer separates what reporting has verified from what is still claimed. Several outlets checked parts of the DHS data leak against known employees and found matches, which supports the core claim that a large set of real DHS-related records was published. At the same time, no outlet in the reporting reviewed here verified every entry, and the route by which the records were obtained remains disputed. Okta, the company named in that claim, said it had found no evidence that its own systems or data were compromised. Readers should therefore treat the size and existence of the archive as reported and partly checked, and the explanation for how it was taken as an allegation that has not been settled.
What the DHS data leak exposed
The DHS data leak exposed names, job titles, work email addresses, phone numbers and office locations, according to multiple reports describing the archive. Some entries also listed supervisors and internal group memberships. The group names matter more than they first appear. They describe access to internal tools and, in some cases, the kind of work a team does, including surveillance, computer forensics and undercover work, as described by Nextgov/FCW. An analysis reported by WIRED and summarised in later coverage also referred to tools including Palantir's Falcon platform, PenLink and the Mobile Fortify facial-recognition app. Those references do not prove that any particular operation was compromised, but they show why security researchers treated the DHS data leak as more sensitive than a simple contact list.
Precision matters here. The accounts reviewed here describe work addresses, office locations and work contact details in the DHS data leak, not home addresses. Some social-media posts went further, but the reporting found for this article does not support a claim that home addresses were included. The same caution applies to claims that specific undercover agents were named. WIRED's reporting, as summarised in later analysis, pointed to group memberships tied to undercover operations and surveillance tools. That is an inference from group names, not independent confirmation that a particular undercover agent was identified by name.
Who was affected in the DHS data leak
More than 21,000 of the records in the DHS data leak related to Customs and Border Protection (CBP), the largest group in the archive, according to the breakdowns reported. The next largest groups were Immigration and Customs Enforcement (ICE), United States Citizenship and Immigration Services (USCIS) and the Cybersecurity and Infrastructure Security Agency (CISA), alongside DHS headquarters and other components. Seven component agencies were covered in total, according to the WIRED analysis summarised in coverage of the leak.
The ICE figure in the DHS data leak differs between reports, and readers comparing headlines should know why. One breakdown put nearly 6,600 records under ICE, while another put about 10,000 records under ICE together with its Homeland Security Investigations (HSI) division. The two figures are not necessarily contradictory: they group the agencies differently. USCIS accounted for about 6,200 records in the WIRED breakdown, and CISA accounted for nearly 1,000, of which more than half were described as contractors in that breakdown. Against a DHS workforce reported at roughly 220,000 people, more than 41,000 records is a substantial share. Some reports put the total at almost 42,000, so the safest wording is the one used throughout this article: more than 41,000 records.
Not every record in the DHS data leak should be read as a currently serving employee. Nextgov/FCW reported that some records appeared to be historical and identified names of people who had since left roles at CISA. Other reports likewise described the archive as covering current and former employees and contractors. That does not make the disclosure harmless: former staff can still be targets for impersonation, and old reporting lines can still reveal how teams were organised. DDoSecrets itself said the release was not intended as a complete directory of DHS personnel, according to its co-founder Emma Best, who described the purpose as replacing anonymity with accountability and supporting journalism, public-records requests and congressional oversight. ICE's enforcement work has separately been prominent in United States news in 2026; for background on how an individual case has played out, see the separate account of the Moussa Diawara ICE case.
What is Icepick and who published it?
Icepick is the name given to the published archive at the centre of the DHS data leak. DDoSecrets, a nonprofit that publishes leaked datasets, hosted and distributed it, and a searchable version was built with the involvement of the Swiss hacker and journalist known as maia arson crimew. Crimew said on X that she was not involved in procuring the data and had worked on the story as a journalist conducting source work, research and data work, according to Nextgov/FCW. The group that said it obtained the records calls itself the Department of Peace. In a note left with the data, quoted in several reports, the group said: "They have our information, so it's only fair that we have theirs." A group spokesperson also tied the DHS data leak to a July pledge by DHS Secretary Markwayne Mullin to intensify immigration enforcement, presenting the leak as a response to his remark that he was "turning up the heat".
The timestamps in the DHS data leak point to mid-August 2026. WIRED's analysis put the last update at 19 August 2026, and other reports described the data as exported around mid-August. That leaves a gap of about two months between the apparent collection date and publication on 28 October 2026. The reporting reviewed here does not establish what happened in that interval, whether DHS knew about the collection before publication, or whether any underlying access route has since been closed. Those are open questions, not details that can be filled in by assumption.
Was the DHS data leak verified?
Verification of the DHS data leak so far is partial, and the outlets involved have been open about its limits. TechCrunch, which first reported the leak, said it verified a portion of the records by matching several known DHS employees against an offline copy of the database. Nextgov/FCW corroborated portions independently, including one official's work phone number that its reporter had obtained before the leak, checks showing that several other listed numbers were associated with AT&T, which provides communications services to DHS, and LinkedIn profiles matching the job titles and positions listed for several people named in the data. Reuters was also reported to have matched records against known employees and contacted some of them. Those checks support the conclusion that the DHS data leak contains genuine DHS-related records. They do not establish that all 41,000-plus entries are accurate, current or complete.
No reporting reviewed here claims a full audit of the DHS data leak. Some entries are historical. The route of collection is claimed, not confirmed. And the full scope of sensitive information in the group names has not been independently verified entry by entry. One careful analysis warned that viral posts overstated some details and that provenance claims in this area deserve scrutiny, pointing to an earlier 2026 leak of ICE and Border Patrol staff information that was later reported to lean heavily on publicly posted material. That earlier episode does not disprove Icepick, but it is a reason to keep the language in this article at the level the evidence supports: reported, partly checked, and still disputed in part.
The Okta dispute at the centre of the DHS data leak
The sharpest dispute in the DHS data leak is over Okta. DDoSecrets and the Department of Peace said the records came from DHS's Okta single sign-on system, the service that lets employees reach several workplace applications with one login. That claim, if correct, would make the DHS data leak a story about identity and access controls, not just about a copied directory. A single sign-on directory holds the links between people, teams and permissions, so a copy of it can show who can reach which internal systems. For readers unfamiliar with the underlying idea, what cybersecurity means and how people protect themselves online explains the basic concepts behind logins, access controls and impersonation risks in plainer terms.
Okta rejected the implication that its own systems were breached. A company spokesperson said: "Okta is secure, and we have no evidence our data or systems were compromised." The two positions are compatible in one respect: data described as coming through an Okta-based login service used by DHS is not the same as a breach of Okta's own infrastructure, and the reporting does not resolve which system, account or configuration, if any, was misused. DHS said it was aware of a potential breach and was actively working to address the situation swiftly and effectively, working to protect employees and promising more information when available, according to Nextgov/FCW. No public statement reviewed here named a cause, a timeline for a fix, or a count of employees notified.
Why the DHS data leak matters beyond names and phone numbers
The practical risk named in reporting on the DHS data leak is not embarrassment. It is targeting and impersonation. Nextgov/FCW noted that exposing employees' assignments and professional connections can help malicious actors identify sensitive targets and craft convincing impersonation attempts. A phone number and a job title on their own may look minor, but combined with a supervisor's name, an office location and a list of the systems a person can access, they give an impersonator plausible detail. Alexander Leslie, a national security expert at Recorded Future quoted in coverage of the WIRED analysis, said that if authentic and current, the archive would be an extraordinarily valuable intelligence resource for those seeking to penetrate DHS. The conditional wording matters: the value depends on authenticity and currency, which have only been partly checked.
There is also an accountability argument in the DHS data leak, and it should be reported fairly rather than dismissed. DDoSecrets and its supporters present the release as a tool for public oversight of a powerful enforcement department. Critics, including the department itself in its general response, emphasise the safety of individual employees and the risk to operations. Both concerns can be real at the same time. The DHS data leak also arrived alongside other reports of federal personnel data being exposed, including sensitive FBI employee records and a Defense Manpower Data Center breach affecting roughly 3 million people, as noted by Nextgov/FCW. Large data breaches have become a recurring pattern in 2026, as shown by the separate report of the Coinbase data breach affecting four firms in one day. The DHS case stands out because the records concern law-enforcement and security staff and because the access-group information adds an operational dimension.
What happens next
Three questions will decide how the DHS data leak develops. The first is verification: whether DHS, Okta or an independent reviewer publishes findings on how the records were collected, how many are current, and whether the access route involved has been closed. The second is scope: whether further reporting establishes how much of the group-name information describes live operations, and whether any individual was harmed through impersonation or targeting linked to the archive. The third is accountability: whether Congress, inspectors general or courts seek the underlying records and the department's account of its identity controls. None of those questions had a public answer in the reporting reviewed for this article, and this article will need updating when one does.
For now, the verified core of the DHS data leak is narrow and important. A large archive of DHS work records, called Icepick, was published on 28 October 2026, covering more than 41,000 employees and contractors. Parts of it were checked against known employees and matched. The publishers say it came through DHS's Okta login service; Okta says it has no evidence its systems were compromised; DHS says it is working to protect employees and will share more information when available. Everything beyond that core, including the exact collection method, the currency of every entry and the operational meaning of every group name, remains reported or claimed rather than settled. That is the line this explainer has tried to hold, because in a leak of this kind the difference between a verified fact and a plausible claim is the story itself.
Sources: Nextgov/FCW reporting on the publication on 28 October 2026, the Department of Peace claim, maia arson crimew's role, the corroboration checks, historical records, the DHS statement, the Okta statement, the Mullin remark, Emma Best's accountability comment, and the FBI and Pentagon breach context; WIRED analysis as summarised in later coverage for the 19 August 2026 update date, the agency breakdown including about 21,000 CBP records, about 10,000 ICE and Homeland Security Investigations records, about 6,200 USCIS records and nearly 1,000 CISA records, the more than 55,000 group names, and the Palantir Falcon, PenLink and Mobile Fortify references, together with the Recorded Future comment; TechCrunch reporting as described in later coverage for first reporting the leak and verifying a portion of the records; and other news reports for the nearly 6,600 ICE figure, the almost 42,000 total in some accounts, and the roughly 220,000 workforce figure. Where reports differed on agency totals, this article follows the breakdowns above and labels the differences as differences in reporting, not as settled facts. This article is trending per news coverage; no ranking claim is made.