DHS Data Leak Exposes 41,000+ ICE and CBP Workers: What We Know

The DHS data leak is one of the biggest exposures of US government staff we have seen. On October 28, 2026, a leak site named more than 41,000 Department of Homeland Security (DHS) workers. The list covers both employees and contractors. The files name people at Immigration and Customs Enforcement (ICE) and US Customs and Border Protection (CBP). Some of them work on undercover and surveillance jobs.

So, what exactly leaked, who is behind it, and why does it matter for markets? In this guide, we walk through the verified facts. We also look at the identity security angle, the cost of breaches, and the stocks tied to the story.

What Happened in the DHS Data Leak?

A hacktivist group calling itself the Department of Peace says it took the data. It then handed copies to Distributed Denial of Secrets, a nonprofit that hosts leaked files. The group is often called DDoSecrets. It published the archive on Wednesday, October 28, under the name “Icepick.”

According to the DDoSecrets release page, the database identifies more than 41,000 DHS employees. It shows names, offices, contact details, and job assignments. The download is about 166.7 MB. A hacker and researcher known as maia arson crimew also built a public search tool for the records.

The hackers left a short note with the files. “They have our information, so it’s only fair that we have theirs,” it said, as WIRED reported.

Why the hackers say they did it

The group tied the leak to DHS Secretary Markwayne Mullin. “On July 17th, Markwayne Mullin said he was ‘turning up the heat,'” a spokesperson said. “This is what happens to ICE when you do that.” NPR and other outlets quoted the same statement.

In addition, DDoSecrets cofounder Emma Best said the data is not a full staff list. Instead, she said it names “many of the architects and drivers of DHS policy and operations.” Supporters say it will help reporters and people filing public records requests.

Who Is Exposed in the DHS Employee Data Breach?

The DHS employee data breach covers DHS headquarters and several of its agencies. WIRED’s analysis found records for seven component agencies. The data was last updated on August 19, 2026.

Here is the rough breakdown, based on reporting from WIRED and TechCrunch:

• CBP: about 21,000 records, or more than half of the total.
• ICE: about 10,000 records. Roughly a third sit in Homeland Security Investigations, the ICE investigative wing.
• US Citizenship and Immigration Services: about 6,200 records.
• Cybersecurity and Infrastructure Security Agency: nearly 1,000 records, over half of them contractors.
• Others: staff at DHS headquarters and the Federal Protective Service.

Estimates of the share of the workforce differ. TechCrunch and NPR put it at about one-fifth of a staff of roughly 220,000. WIRED, however, put it closer to one-seventh. Either way, this is far from every DHS worker.

What details the records include

The files list names, job titles, work emails, cell phone numbers, and office locations. Most records also name a supervisor. That means anyone can rebuild reporting lines across the department.

Beyond contact details, the data shows membership in internal permission groups. WIRED counted over 55,000 such groups. Some names point to wiretap programs and undercover work. For example, 39 Homeland Security Investigations staff sit in groups marked “CUC.” Court filings say it means “certified undercover operation.”

How Did the US Immigration Agents Database Leak Happen?

The hackers claim they pulled the data from an Okta single sign-on system. Single sign-on lets staff log in once to reach many work apps. DHS uses this tool across its agencies, according to TechCrunch.

Okta, though, pushed back firmly. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” a spokesperson told WIRED. So, right now, we only have the hackers’ word on the entry point.

Meanwhile, the timestamps on the records suggest they were copied around mid-August. TechCrunch said it is unclear whether the weakness has been fixed.

Is the leaked DHS data real?

Several newsrooms checked parts of it. TechCrunch matched names of known DHS staff against a copy of the database. Reuters matched details for about six employees to credit bureau records, as The Guardian reported. Reuters also called three staff and confirmed their phone numbers.

Likewise, The Washington Post said it verified the database with current and former DHS officials, per Newsday. Still, DDoSecrets warns the files may contain errors.

How DHS and Others Responded to the Leak

DHS gave a short statement to several outlets. “DHS is aware of a potential breach,” a spokesperson said. The agency said it is “actively working to address the situation swiftly and effectively.” It added that it takes threats against its officers seriously.

Former officials sounded worried. John Sandweg, an acting ICE director under President Obama, called it a “nightmare scenario,” Newsday reported. He said naming agents could put them “in great jeopardy” and hurt cartel and gang cases.

Security experts raised a similar alarm. Alexander Leslie works at the threat intelligence firm Recorded Future. He told WIRED the data could be “an extraordinarily valuable intelligence resource” for attackers. Plus, it gets more useful when combined with other leaked data.

On the other hand, transparency groups welcomed it. Ryan Shapiro leads the nonprofit Property of the People. He said emails and phone numbers are “indispensable tools” for records requests. Bluesky, meanwhile, began blocking links to the archive, WIRED reported, because it shares contact details without consent.

A string of government breaches

This is not an isolated case. In September, the group ShinyHunters claimed it stole data on FBI staff. Later, the Defense Department faced a class action lawsuit over a breach of military personnel data, The Guardian said.

DHS itself has a history here. A 2014 breach may have exposed data on 390,000 people, CyberScoop noted. Then in 2018, DHS notified nearly 250,000 people of another breach.

What the DHS Data Leak Means for Investors

For markets, the DHS data leak is mostly a story about identity security. Login systems now guard the keys to whole organizations. When one is linked to a breach, even without proof, the vendor’s name ends up in the headlines.

Okta and identity security stocks

Okta (OKTA) sits at the center of the claims. It firmly denies any breach of its own systems. Even so, investors may watch for any update from DHS on how the hackers got in. Notably, a stolen password or a misconfigured account is not the same as a flaw in Okta’s product.

We have covered Okta before, including Citigroup’s upgrade in May 2026. For a wider view, see our piece on cybersecurity stocks hitting records.

Government tech contractors in the files

The permission groups also name tools from big contractors. WIRED found groups tied to Palantir (PLTR) and its Falcon investigative platform. TechCrunch said most staff belonged to a group for Microsoft (MSFT) 365, which hosts DHS email and files.

To be clear, no report says these firms were hacked. However, the leak shows how many outside vendors touch federal work. That can draw more political attention to government tech contracts.

The rising cost of a data breach

Breaches are getting pricier. IBM’s 2026 Cost of a Data Breach Report puts the global average at a record $4.99 million. In the US, the average hit $11.5 million, more than twice the global figure.

Also, 85% of breached firms told IBM they plan to raise security spending. That trend can support demand for security tools over time. Of course, it does not guarantee gains for any single stock.

How to Protect Yourself After a Data Breach

Most of us are not DHS workers. Yet the same lessons apply to anyone whose data leaks online. Here are simple steps:

• Turn on multi-factor login for email, banking, and work accounts.
• Watch for phishing calls, texts, and emails that use your name and job title.
• Freeze your credit if your personal details were exposed.
• Use unique passwords and a trusted password manager.

For more tips, read our guide to 10 cybersecurity habits experts swear by.

What Comes Next in the DHS Data Leak Story

Several questions remain open. First, DHS has not said how the hackers got in. Second, it is unclear whether the flaw is closed. Third, it is unclear if anyone will face charges. The administration has prosecuted protesters for posting ICE officer details before, WIRED noted.

The leak also lands amid a heated fight over immigration enforcement. We have tracked that debate in stories like the ICE detention bond ruling and Secretary Mullin’s earlier backlash.

Conclusion

The DHS data leak exposed details on more than 41,000 employees and contractors. It reaches from border agents to senior leaders. The hackers point to Okta, while Okta says its systems are secure. DHS is still investigating. For investors, the big themes are identity security, contractor risk, and the rising cost of breaches. We will keep watching for official findings.

FAQs

What is the DHS data leak?

It is the October 28, 2026, release of records on more than 41,000 DHS employees and contractors. A group called Department of Peace took the data. DDoSecrets then published it as “Icepick.”

Which agencies were affected by the DHS employee data breach?

The files cover DHS headquarters and seven component agencies. CBP has about 21,000 records and ICE about 10,000. Citizenship and Immigration Services, the cybersecurity agency, and the Federal Protective Service also appear.

Was Okta hacked in the DHS leak?

The hackers say the data came from an Okta single sign-on system used by DHS. Okta says it is secure and has no evidence its data or systems were compromised.

What did DHS say about the data leak?

DHS said it is aware of a potential breach. It said it is working to address the situation swiftly and to ensure staff are properly protected.

How much does a data breach cost?

IBM’s 2026 report puts the global average cost at $4.99 million. The US average is higher, at a record $11.5 million per breach.

Explore Smarter Stock Research With Meyka

Big cyber events can move security and tech stocks fast. Good data helps you keep up. Meyka is an AI-powered stock research and alternative-data platform. It helps you track companies, markets, and trends in one place. If you are interested in the stock market, check out Meyka and see how it can support your research.

Disclaimer: This article is for informational purposes only and is not financial advice. Always do your own research or consult a licensed financial advisor before making investment decisions.