Personal data for nearly 42,000 Department of Homeland Security employees was leaked online Wednesday by a hacking group identified as the Department of Peace. The breach, which the group says utilized an Okta single sign-on service, exposed names, job assignments, and contact details for staff across multiple federal immigration and security agencies.
Scope of the Department of Homeland Security Breach
The leaked dataset includes information for roughly one in five employees on the department’s payroll. The compromised records feature names, work addresses, email addresses, and phone numbers, alongside internal job descriptions. According to reports, the exposed personnel span several key agencies, including Immigration and Customs Enforcement (ICE), Customs and Border Protection (CBP), Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, and U.S. Citizenship and Immigration Services.
The information was published in a database titled “Icepick” on a website hosted by Distributed Denial of Secrets. Hackers obtained the data through an Okta single sign-on service, though a spokeswoman for Okta maintains that Okta is secure, and we have no evidence that our data or systems have been compromised.
Motivations and Identity of the Department of Peace
The group responsible for the breach, calling itself the Department of Peace, stated that the leak was intended to replace anonymity with accountability.
DDoSecrets co-founder Emma Best further characterized the leak as a way to identify many of the architects and drivers of DHS policy,
as well as officials overseeing what she described as the administration’s ever-growing rendition and deportation programs.
A spokesperson for the hackers linked the timing of the release to remarks made by DHS Secretary Markwayne Mullin on July 17, when he claimed he was turning up the heat.
The spokesperson added, This is what happens with ICE when you do that.
Impact on Specific Enforcement Operations
The dataset allows for the categorization of employees into specific user groups, including those labeled as Undercover Operations and Covert Operations. The information has already been used to identify individual agents involved in high-profile incidents.
A search tool created by the hackers confirmed the identities of Jesus Ochoa and Raymundo Gutierrez, two CBP agents involved in the January shooting death of protester Alex Pretti. Officials have previously justified the practice of keeping agent identities hidden by citing concerns over threats against personnel following the return of the Trump administration.
Officials Decline to Comment on the Security Breach Timing
It remains unclear exactly when the security breach occurred. The incident follows a series of recent cyberattacks targeting U.S. government entities, including a breach of FBI agent information by the group ShinyHunters and a suspected hacking attempt that forced the Federal Election Commission offline.
Representatives for the Department of Homeland Security, ICE, and CBP did not immediately respond to requests for comment regarding the leak or the status of their internal systems.
