DHS Data Breach Exposes 40,000 ICE and CBP Staff Records

A hacking group has put the names, job titles and work contact details of more than 40,000 Homeland Security employees online, most of them in CBP and ICE. DHS says it is working to address a “potential breach.”

A DHS data breach has exposed personnel records for more than 40,000 Department of Homeland Security employees, with Customs and Border Protection and Immigration and Customs Enforcement making up the large majority, according to NPR and TechCrunch reporting on Oct. 28. The records, published by the transparency group Distributed Denial of Secrets as a searchable database called “Icepick,” cover border officers, deportation officers, investigators and senior officials.

The timing matters as much as the size. All year, states, cities and federal courts have fought over how much the public may know about the officers who carry out immigration arrests, from Virginia’s ICE mask ban now before the Fourth Circuit to the Justice Department’s suit against Denver’s ban on masked agents. A database that names tens of thousands of DHS employees sidesteps that legal fight entirely.

What the DHS data breach contains, and what is only claimed

The two outlets that examined the material agree on its scale but not on every detail, and some claims come only from the people who released it.

Point	Status
More than 40,000 DHS personnel records, including about 21,000 tied to CBP and about 10,000 tied to ICE and Homeland Security Investigations	Reported by both TechCrunch and NPR
Just under 1,000 records tied to the Cybersecurity and Infrastructure Security Agency, plus thousands from headquarters, USCIS and the Federal Protective Service	Reported by TechCrunch
The data is authentic	TechCrunch verified a portion by matching names of known DHS employees
Records were taken around mid-August	TechCrunch, based on timestamps in the records
The data came through DHS’s single sign-on system	Claimed by the hackers; Okta told TechCrunch it has no evidence its systems were compromised
The records include people involved in undercover operations	Reported by NPR only

Sources: TechCrunch and NPR reporting published Oct. 28, 2026.

Neither outlet reported that records of immigration applicants, petitioners or detainees were part of the leak. It is a workforce file, not a case file, so nothing reported so far suggests that people with matters pending before USCIS, ICE or CBP had their own data exposed.

The file is still revealing. TechCrunch found it includes internal access-group memberships, in effect a map of who uses which tools. More than 2,000 HSI users sit in groups referencing the surveillance-software company Penlink, and more than 200 CBP users are tied to Mobile Fortify, a facial recognition app. For researchers and litigants trying to learn how widely such tools are used, those lists may matter more than the names.

The leak covers roughly one-fifth of a DHS workforce of about 220,000, both outlets reported. It is also about nine times larger than the January leak of close to 4,500 Border Patrol and ICE employees to the ICE List website, which The National News Desk reported at the time (a calculation from the two reported figures).

Oversight tool or doxxing: the two positions

The hackers, who call themselves the Department of Peace, framed the release as retaliation for enforcement policy. “On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” the group said in a statement quoted by NPR. Ryan Ottignon, a journalist who helped build the searchable version, told NPR the project is “one step in that oversight process” and rejected the label of doxxing.

DHS has said little so far beyond confirming it is “aware of a potential breach and is actively working to address the situation swiftly and effectively,” and that it is taking steps to “ensure all are properly protected,” according to NPR. The department’s view of such disclosures is on the record from the January leak, when Assistant Secretary Tricia McLaughlin told The National News Desk that “the disgusting doxxing of our officers put their lives and their families in serious danger” and that “anyone who doxxes our officers will be prosecuted to the fullest extent of the law.”

Where this is likely to go

A criminal case is the likeliest federal response. Unauthorized access to a government computer system falls under the Computer Fraud and Abuse Act, 18 U.S.C. 1030. Publishers are a harder target: in Bartnicki v. Vopper (2001), the Supreme Court held that the First Amendment can protect publishing truthful information on a public matter even when someone else obtained it unlawfully, the ground DDoSecrets and the journalists involved are likely to stand on.

The leak will feed the officer-identification fight. Supporters of state mask bans can cite it as evidence that anonymity is already gone; opponents can cite it as proof that exposure is a real risk that justifies stronger anti-doxxing protections.

Security questions will follow. TechCrunch said it is unclear whether the weakness has been fixed or whether DHS knew of the theft. For a department that is also widening its enforcement reach through 287(g) partnerships with local police, how records for a fifth of its workforce left its systems is likely to draw congressional oversight questions.

This article is for general information and is not legal advice.

Sources

Vasanth Vaidyanathan, Esq.

Administrator

Vasanth Vaidyanathan is an immigration attorney with over 20 years of experience focused exclusively on U.S. immigration and nationality law. He holds a LL.M. from California Western School of Law, San Deigo and advises individuals and businesses on employment and family-based immigration matters, including H-1B, PERM, EB categories, and adjustment of status. He has also been a featured speaker at immigration seminars across the U.S. To reach Vasanth visit: https://www.vnathan.com/

Author's website Author's posts