WASHINGTON (Diya TV) — A searchable database published this week exposes records on more than 41,000 Department of Homeland Security employees and contractors. The files include names, work contact details, job titles, office locations and internal group memberships. Some entries point to undercover operations, surveillance programs and investigative tools, according to a review of the data.
The leak could put personnel at risk and offer adversaries a detailed picture of how DHS organizes its work. Security experts warn that bad actors could combine the information with other data to impersonate employees, target individuals or disrupt investigations. The records do not establish that every named person took part in the activity suggested by a group label, or that every entry remains current.
DHS said Wednesday it was responding to a potential breach and working to protect employees. On Thursday, White House border official Tom Homan said the Justice Department was investigating. He warned that publishing officers’ identities could put them and their families at risk.
A group calling itself the Department of Peace claimed it obtained the files through DHS’s employee sign-on system and gave them to Distributed Denial of Secrets, which published the archive as “Icepick.” Researcher Maia Arson built a tool to search the records. The hackers’ account of how they accessed the data remains unverified. Okta, the sign-on provider named in the claim, said it found no evidence that its own systems or data had been compromised.
The database spans DHS and seven component agencies, including Customs and Border Protection, Immigration and Customs Enforcement, U.S. Citizenship and Immigration Services, and the Cybersecurity and Infrastructure Security Agency. A detailed review found that CBP accounts for more than half the entries, ICE for about 10,000 and USCIS for roughly 6,200. The collection also includes contractor and associate records.
The files list more than employee names and phone numbers. They include supervisors and internal access groups, which can help reconstruct reporting relationships and show which personnel may use particular systems. Some group names refer to certified undercover operations, wiretap programs and surveillance tools. Others appear connected to Mobile Fortify, a facial-recognition app used by immigration agents, or to software for analyzing phone and social-media data. These references raise security concerns, but they do not independently confirm an employee’s current duties or access.
Alexander Leslie, a national security expert at Recorded Future, warned that the data could become more valuable when combined with commercial records or previous breaches. That could help attackers craft convincing impersonation attempts or identify people vulnerable to targeting, he said.
The publication has also triggered a dispute over whether to take the database offline. DHS asked Icelandic hosting provider FlokiNET to remove or restrict the files, warning they could enable harassment, stalking or physical harm. The company’s chief executive said it would not take them down because the published contacts appeared to be work addresses and phone numbers rather than personal contact details.
Bluesky blocked links to the archive, citing its rules against sharing people’s contact information without permission. The company said it wanted to restrict access to the files without suppressing broader discussion or reporting about them. The Department of Peace presented the release as an accountability measure amid public criticism of the Trump administration’s immigration enforcement campaign. But the database’s searchable format and inclusion of personnel connected to sensitive work sharpen the conflict between public oversight and employee safety.
Investigators have not publicly explained how the group obtained the records, whether it accessed DHS systems directly or what information the department has secured since the leak. Those answers will determine whether Icepick exposes a personnel directory—or evidence of a deeper compromise of DHS operations.
