The Department of Homeland Security (DHS) suffered one of the most extensive exposures of personnel information ever recorded. A hacker collective calling itself “Department of Peace” published an archive dubbed “Icepick,” which contains email addresses, phone numbers, office locations and, crucially, references to internal permission groups that govern access to surveillance platforms. The data set was last refreshed on August 19, 2026 and appears to have been harvested from the agency’s Okta single-sign-on system.
While the breach itself is alarming, the real insight comes from the way the files map the department’s internal hierarchy. They show how senior leadership, field agents, and even contracted personnel are linked to specific technology stacks, including facial-recognition apps and phone-metadata analysis tools. For anyone tracking federal cyber-operations, the archive offers a rare, granular view of a sprawling government agency.
Scope of the leak and categories of information released
In total, the dump covers roughly one-seventh of DHS’s workforce—about 41,000 individuals out of an estimated 220,000. Each record lists the employee’s name, job title, official email, cell number and work address. Beyond contact data, the archive also includes the list of Okta groups each person belongs to, which acts as a proxy for the internal applications they can reach. This structure reveals not only who works where, but also which surveillance tools and data-analysis platforms they can invoke.
Among the most sensitive entries are groups whose names hint at covert operations. For example, a cluster of 39 personnel across several field offices belongs to a group labelled “CUC,” identified in court filings as a “certified undercover operation.” Another set, linked to HSI’s St. Paul office, references “Keyhole,” a program used to monitor protest activity in Minneapolis earlier this year. Additional permissions reference the “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program,” and an “Illicit Sensor Intercept Program (ISIP).”
Agencies most affected and the numbers behind them
Customs and Border Protection (CBP) dominates the list, accounting for more than half of the exposed entries—about 21,000 records. These include staff stationed at airports, seaports and land crossings, many of whom handle day-to-day interactions with travelers. Immigration and Customs Enforcement (ICE) contributes roughly 10,000 records, with a third of those belonging to the Homeland Security Investigations (HSI) division, which conducts complex investigations ranging from immigration fraud to transnational crime.
The Cybersecurity and Infrastructure Security Agency (CISA) appears with just under 1,000 entries, most of them contractors. Additional files belong to U.S. Citizenship and Immigration Services (USCIS), the Federal Protective Service and various headquarters personnel. Together, the dataset paints a picture of a department whose operational breadth stretches from border checkpoints to cyber-defense labs.
Internal permission groups and the technology they expose
Analysis of the permission groups uncovers a heavy reliance on commercial analytics platforms. References to Palantir’s Falcon investigative suite, Google’s Gemini, Microsoft’s Copilot and OpenAI’s ChatGPT appear alongside niche tools such as PenLink, which parses phone-call metadata, and Mobile Fortify, a facial-recognition application.
Two particular groups—named “Executive Leadership” and “AI Access”—list the same thirteen individuals, granting them exceptions to the department’s web-filter. The roster includes former DHS secretary Kristi Noem, former chief information officer Antoine McCord (now back at Anduril), senior adviser Philip Hegseth, and policy adviser Jayce Krachenfels, who previously directed Donald Trump’s 2024 campaign in a regional capacity. Their inclusion highlights the blend of political appointees and tech executives who navigate the agency’s digital ecosystem.
Official responses and broader implications
A DHS spokesperson confirmed awareness of a “potential breach” and pledged swift remedial action, emphasizing the agency’s commitment to protecting its workforce. The statement read, “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected.” An Okta representative, meanwhile, denied any compromise of its infrastructure, asserting, “Okta is secure, and we have no evidence our data or systems were compromised.”
The leak arrives amid a pattern of increasing scrutiny on federal agencies’ data-handling practices. Earlier this year, a separate breach exposed thousands of FBI employee records, while a prior incident revealed a trove of DHS contracts with private security vendors. Cyber-security analysts warn that the combination of personal identifiers and access-group details could enable adversaries to craft highly targeted phishing campaigns or to map out the United States’ internal surveillance architecture.
National-security expert Alexander Leslie of Recorded Future described the dump as “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” noting that when correlated with other compromised datasets, the information could “significantly accelerate threat-actor reconnaissance.” The public availability of such a detailed internal roadmap underscores the urgent need for robust identity-management safeguards and a reassessment of how government entities classify and protect personnel data.
