13:05Machine-translated from Azerbaijani by AIRead in Azerbaijani
Data of 41,000 People Leaked from US Department of Homeland Security
A major data leak at the US Department of Homeland Security (DHS) has affected more than 41,000 employees and contractors. Records posted online contain their names, job titles, email addresses, phone numbers, and workplaces. The list also includes undercover ICE agents and senior officials. The files also disclosed information about covert operations, surveillance programs, and internal systems.
Of the records in the leaked database, 21,000 belong to CBP employees. Another 10,000 records relate to ICE employees. About 1 in 3 of them work in the Homeland Security Investigations division. There are 6,200 records for US Citizenship and Immigration Services and nearly 1,000 for CISA. Although estimates vary, the leak may cover approximately 1 in 7 to 1 in 5 DHS employees. An activist hacker group called “Department of Peace” has claimed responsibility for the attack. According to the group, the data was obtained from “Okta,” a system used for single sign-on within DHS. The files were shared with the “DDoSecrets” organization and cybersecurity researcher maia arson crimew. A searchable database called “Icepick” was then created using this data. The records were last updated on August 19, 2026. The database lists more than 55,000 access groups. These groups show which internal systems and programs each employee could use. At least 39 HSI employees belong to groups associated with officially authorized covert operations. Other records show access to the “Keyhole” operation and wiretaps. The list also includes the “Palantir Falcon,” “PenLink,” “ChatGPT,” “Gemini,” “Copilot,” and “Grok” services.
Approximately 4,500 users are listed in the “Headspace_users” group. “Headspace” had signed an $82,500 (approximately 140,250 manats) psychological support contract with ICE. The contract ended in 2023, and the company stated that it had not provided services since then. In addition, more than 700 accounts appear in a group associated with “Signal.” More than 200 CBP accounts were used in the “Mobile Fortify” app, which identifies people using facial recognition.
A total of 1,300 accounts belonging to ICE’s enforcement division were created after July 4, 2025. A law signed that day funded the hiring of 10,000 new ICE employees. These funds were allocated for recruitment through the end of 2025. Another 170 accounts were linked to military support at ICE facilities, while 35 accounts were associated with members of the National Guard. The database’s 4,400 support staff include programmers, data specialists, medical personnel, and detention center employees. More than 300 other records belong to people holding senior positions in DHS leadership. According to security experts, the leaked data could be used to create false identities, target employees, and interfere with ongoing investigations. DHS said it was aware of the incident and was investigating to protect its employees. “Okta” says it has found no evidence that its data or systems were compromised. The incident follows other major cases involving leaks of information about FBI employees and the Pentagon’s military personnel database.
Of the records in the leaked database, 21,000 belong to CBP employees. Another 10,000 records relate to ICE employees. About 1 in 3 of them work in the Homeland Security Investigations division. There are 6,200 records for US Citizenship and Immigration Services and nearly 1,000 for CISA. Although estimates vary, the leak may cover approximately 1 in 7 to 1 in 5 DHS employees. An activist hacker group called “Department of Peace” has claimed responsibility for the attack. According to the group, the data was obtained from “Okta,” a system used for single sign-on within DHS. The files were shared with the “DDoSecrets” organization and cybersecurity researcher maia arson crimew. A searchable database called “Icepick” was then created using this data. The records were last updated on August 19, 2026. The database lists more than 55,000 access groups. These groups show which internal systems and programs each employee could use. At least 39 HSI employees belong to groups associated with officially authorized covert operations. Other records show access to the “Keyhole” operation and wiretaps. The list also includes the “Palantir Falcon,” “PenLink,” “ChatGPT,” “Gemini,” “Copilot,” and “Grok” services. Approximately 4,500 users are listed in the “Headspace_users” group. “Headspace” had signed an $82,500 (approximately 140,250 manats) psychological support contract with ICE. The contract ended in 2023, and the company stated that it had not provided services since then. In addition, more than 700 accounts appear in a group associated with “Signal.” More than 200 CBP accounts were used in the “Mobile Fortify” app, which identifies people using facial recognition. A total of 1,300 accounts belonging to ICE’s enforcement division were created after July 4, 2025. A law signed that day funded the hiring of 10,000 new ICE employees. These funds were allocated for recruitment through the end of 2025. Another 170 accounts were linked to military support at ICE facilities, while 35 accounts were associated with members of the National Guard. The database’s 4,400 support staff include programmers, data specialists, medical personnel, and detention center employees. More than 300 other records belong to people holding senior positions in DHS leadership. According to security experts, the leaked data could be used to create false identities, target employees, and interfere with ongoing investigations. DHS said it was aware of the incident and was investigating to protect its employees. “Okta” says it has found no evidence that its data or systems were compromised. The incident follows other major cases involving leaks of information about FBI employees and the Pentagon’s military personnel database.