-
A searchable online database reportedly holds records of staff from several US Homeland Security agencies, including ICE, CBP, and CISA.
-
The records list names, phone numbers, work emails, job titles, and internal access groups. Some link to undercover and sensitive law enforcement roles.
-
DHS says it is investigating a possible breach. Okta says it found no proof that its own systems were hacked.
A big data leak has exposed records of more than 41,000 people tied to the US Department of Homeland Security (DHS). They include employees and contractors. The leak has raised worries about staff safety and the protection of sensitive government work.
The reports published on October 28, 2026 say the leak covers many agencies. Immigration and Customs Enforcement (ICE) is one of them. Customs and Border Protection (CBP) is another. The list also includes the Cybersecurity and Infrastructure Security Agency (CISA). US Citizenship and Immigration Services (USCIS) appears as well.
The dataset reportedly shows names, work email addresses, and phone numbers. It also lists job titles, office locations, and details about each worker’s internal access groups. Some records seem linked to undercover staff and sensitive law enforcement work.
Journalists have not checked the whole dataset on their own. One news team says it matched some employee details. It could not confirm everything in the release. That means some details may still be unproven.
Database Links Workers to Undercover and Surveillance Roles
The records reportedly connect workers to internal groups. Some groups deal with surveillance and wiretap programs. Others cover digital forensics and law enforcement technology. A few entries also mention Palantir software, Cellebrite tools, and xAI’s Grok chatbot.
Each record can show where a person works and what that person does. Some records also show which groups a worker belongs to. Together, these facts give a detailed view of each worker’s role.
These links could show how different teams work. They could also show who has access to particular systems. Records of undercover ICE staff have caused the most concern. Naming workers in these roles worries many people. Identifying people in sensitive jobs could put them at risk.
Another report says its team reviewed the searchable database. Current and former officials helped the team confirm it was real. A different report says the data holds records of thousands of CBP and ICE employees.
The database is reportedly called Icepick. Distributed Denial of Secrets (DDoSecrets) published it. This nonprofit group shares leaked documents with the public. Hacktivist and journalist maia arson crimew helped build the search tool. The database is publicly searchable, so people can look up entries online.
Group Points to Okta Login Service as the Entry Point
A group called the Department of Peace reportedly supplied the material. It also claimed responsibility for obtaining the data. According to reports, the group said its release came from concerns about DHS activities. It also pointed to the public’s right to information.
The group claims it got the data through DHS’s Okta single sign-on service. This service helps workers log in and reach their systems. No one has independently confirmed that claim.
Okta spoke to reporters about the matter. The company said it found no sign that its systems or data were hacked. So the reports do not show how the leak happened. The incident could come from a hack of Okta itself. It could also come from account misuse or another route. Okta’s statement does not settle the matter either way.
The entry point matters a great deal for the investigation. It would show how the data was taken from the system. It would also show which security steps failed.
DHS Investigates as Safety Fears Grow
DHS says it knows about a possible breach. The department is working to fix the problem and protect affected workers. Earlier reports said DHS had not confirmed the incident. That has now changed. Still, the department’s response does not prove every claim about the dataset.
The leak could cause more harm than lost contact details. Names, job roles, group memberships, and workplace details work well together. Attackers could use them to pose as staff. They could also pick out certain employees. Some might even guess how sensitive government operations connect.
Large-scale data exposure has also affected the private sector, with an underground listing claiming to offer 4.6 million records linked to India’s ACC Limited.
The case also shows the danger of break-ins to login and access systems. A work email alone may look harmless. A job title alone may look harmless too. Joined with an access group and an office location, the same facts say much more. Job assignments and group memberships could also point to which teams work together.
For now, several key questions remain open. The full size of the leak is unknown. So are the exact way in and the truth of every record. DHS’s investigation may show whether stolen passwords, a software flaw, or another failure caused the leak. These answers will help explain how the exposure happened.
Both DHS and Okta have given early statements. Neither one explains how the data left DHS’s systems. Until then, readers should treat claims about the origin and full reach with care.
