Hackers Expose Data on More Than 40,000 DHS Personnel

A hacking group has exposed personal information belonging to more than 40,000 employees and associates of the U.S. Department of Homeland Security (DHS), including personnel connected to undercover operations, according to a report published by NPR on October 28, 2026. The leaked records include names, phone numbers, and addresses, raising concerns about the exposure of government personnel involved in sensitive work.

The group behind the breach, known as the Department of Peace, said it obtained the information by compromising DHS's single sign-on system. According to its online post, the group distributed the stolen data to Distributed Denial of Secrets (DDoSecrets), which published the files in a searchable database called Icepick.

More than 21,000 records identify employees of U.S. Customs and Border Protection, while another 10,000 concern personnel at Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit. The database represents approximately one-fifth of DHS's workforce, which employs slightly more than 220,000 people, according to NPR.

A spokesperson for the Department of Peace linked the breach to comments made by Markwayne Mullin on July 17, framing the release as a response to his stated approach toward immigration enforcement.

"On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," a Department of Peace spokesperson said in an online statement.

The data was also shared with U.S.-based journalist Ryan Ottignon and Swiss hacker maia arson crimew. According to Ottignon, the two collaborated on a searchable database, with crimew handling the technical development.

Emma Best, co-founder of DDoSecrets, described the release as significant because it connects individual officials with responsibilities involving covert operations and deportation programs.

"extraordinary but deceptive in its simplicity," Best said of the leak, explaining that it links "officials responsible for overseeing covert and undercover operations …along with key personnel in DHS's ever-escalating rendition and deportation programs."

Other activists have argued that the records could help researchers investigate DHS activities and submit more targeted freedom of information requests. Such requests can produce limited results when applicants lack identifying details, including names and email addresses.

DHS acknowledged awareness of a potential security incident and said it was working to address the situation. The department did not provide further details about the scope of the breach in the statement cited by NPR.

"aware of a potential breach and is actively working to address the situation swiftly and effectively." DHS said in a statement, adding that it was taking steps to protect those affected.

Ottignon rejected the characterization of the release as doxing government employees, arguing that identifying personnel involved in enforcement activities could support public oversight. He said officers sometimes operate in plain clothes or wear masks, making it difficult for communities to identify them.

"We are in a situation in which a group of public officials go around into cities and states and all around the country, and they seek to hide who they are. Very frequently using masks, wearing plain clothes. And they do universally unspeakable things to these communities," Ottignon said.

He argued that the publication formed part of a broader effort to scrutinize government conduct and promote accountability.

"We need oversight for useful government, if it exists at all. So this is just one step in that oversight process," Ottignon added.

DDoSecrets included a separate statement with the published files to explain its position on the release of government personnel information.

"They have our information, so it's only fair that we have theirs," DDoSecrets wrote in a note attached to the files.

The breach follows similar hacking incidents involving the FBI, according to NPR. However, the available database is not comprehensive, and DHS has not publicly detailed the full extent of the incident in the statement cited by the news outlet.