Hackers Leak Data Of 41,000 DHS Employees, Exposing ICE And CBP Agent Identities

For immigration agents who often conceal their identities during enforcement operations, anonymity has suddenly become harder to maintain.

Hackers have exposed records belonging to more than 41,000 US Department of Homeland Security (DHS) personnel, including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) agents, revealing employee identities, contact information, and sensitive operational details.

The stolen information was published online on October 28, 2026, raising concerns about employee safety and government cybersecurity.
 

TL;DR

• Hackers leaked records of over 41,000 DHS personnel, including more than 21,000 CBP employees and nearly 6,600 ICE employees.
• The exposed data includes names, workplace contact details, agency assignments, and information about undercover operations.
• A group called Department of Peace claims it accessed the records through Okta's single sign-on service, although Okta denies its systems were compromised.
• DHS is investigating the incident.

DHS Data Breach Exposes ICE, CBP And Undercover Agent Records

As per reports, the stolen information contains employee names, work addresses, phone numbers, job descriptions, and details about their responsibilities within DHS.

The records cover multiple agencies, including more than 21,000 CBP employees, nearly 6,600 ICE personnel, and staff from Homeland Security Investigations (HSI), the Federal Protective Service, and the Cybersecurity and Infrastructure Security Agency (CISA).

However, the exposure goes beyond employee directories.

The leaked files reportedly identify previously undisclosed operations, personnel responsible for overseeing undercover investigations, and technologies used by federal agents, including tools supplied by Cellebrite and Palantir.

According to TechCrunch's investigation, the records also contain internal access permissions associated with employees, offering insights into the software and services available across DHS.

The publication verified portions of the stolen dataset, which appears to have been extracted around mid-August 2026.

Source

Department Of Peace Claims Okta Access Enabled DHS Hack

The hacking group Department of Peace claimed responsibility for obtaining the information through Okta, a single sign-on service used to manage access to organizational systems.

The records were subsequently shared with cybersecurity researcher maia arson crimew and the nonprofit Distributed Denial of Secrets (DDoSecrets), before appearing in a publicly accessible database called Icepick.

The group described the publication as an attempt to increase accountability surrounding immigration enforcement rather than provide a complete directory of DHS employees.

However, the precise method used to gain unauthorized access remains unverified.

An Okta spokesperson said, "Okta is secure, and we have no evidence our data or systems were compromised."

The distinction matters because access obtained through an organization's authentication environment does not necessarily establish that the authentication provider itself was breached.

A similar concern over identity-based attacks was highlighted in TechDogs' coverage of Microsoft Entra passkey enrollment attacks targeting enterprise accounts.
 

DHS Responds As Leaked Agent Identities Raise Safety Concerns

The DHS has acknowledged the reported incident and said it is working to address the situation.

A department spokesperson said, "We take all security threats against our employees and officers seriously and will work to ensure all are properly protected."

The exposure is especially sensitive because some immigration agents conduct operations while concealing their identities, amid public criticism of enforcement practices and reported threats against officers.

Former ICE officials have also warned that publishing undercover investigators' identities could jeopardize personnel and ongoing criminal investigations.

The incident follows other reported compromises involving federal personnel information, including a recent FBI employee data theft and the Pentagon data breach involving millions of military personnel records.
 

DHS Cybersecurity Investigation Leaves Key Questions Unanswered

While the stolen records have already been made public, the full extent of unauthorized access remains unclear.

DHS has not publicly explained how the attacker obtained the information, whether the underlying security weakness has been addressed, or what additional safeguards have been introduced for affected personnel.

The leaked database is also not a complete representation of the DHS workforce and may contain inaccuracies.

For now, the incident highlights the security implications of exposing government personnel identities alongside information about their internal systems and operations.