Details of more than 41,000 Department of Homeland Security personnel, including thousands of immigration enforcement agents, were leaked online Wednesday. The breach included names, work addresses and phone numbers of staff from Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Federal Protective Service and the Cybersecurity and Infrastructure Security Agency.
A group called the Department of Peace accessed the information and made it public through journalist maia crimew and the website Distributed Denial of Secrets in a database named Icepick. The Department of Peace said it reached the records through Okta, a single sign-on security service used by organisations to control access to internal platforms.
The leak included more than 21,000 CBP agents and nearly 6,600 ICE agents, along with previously unknown operation names, personnel involved in those operations and technology used, including tools from Cellbrite and Palantir.
A DHS spokesperson said the agency is "aware of a potential breach and is actively working to address the situation swiftly and effectively" and will "work to ensure all are properly protected." An Okta spokeswoman said the company has "no evidence our data or systems were compromised" but acknowledged the company is aware of the claims.
Emma Best, a co-founder of Distributed Denial of Secrets, said the leak aimed to replace "anonymity with accountability" and identified officials overseeing covert operations, government efforts to find leakers and personnel in DHS deportation programs. A Department of Peace spokesperson attributed the hack to recent actions by ICE agents and referenced Markwayne Mullin, who became Secretary of Homeland Security in March, saying "This is what happens to ICE when you do that."
The breach marks the third time in recent weeks a US government agency has been targeted. Last month, the FBI was hacked by a group called ShinyHunters. The Federal Election Commission was taken offline in recent days due to a suspected hacking attempt.