More than 41,000 personal and work records of Department of Homeland Security (DHS) employees, including those working for Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP), were publicly leaked on 28 October 2026, exposing sensitive details such as names, workplace addresses, phone numbers, job titles, and email groups.
The dataset, which also revealed assignments linked to special operations, surveillance, computer forensics, and undercover roles, was published by the hacker group Department of Peace in collaboration with cybersecurity researcher Maia Crimew. The data was shared via the platform Distributed Denial of Secrets (DDoSecrets) under the label “Icepick.”
TechCrunch reported that the leak appeared to originate from DHS’s Okta single sign-on system. However, Reuters could not independently verify this claim, and an Okta spokesperson stated, “Okta is secure, and we have no evidence our data or systems were compromised.” Both Reuters and TechCrunch independently validated parts of the dataset by matching records against known DHS employees and contacting some for confirmation.
The leaked records were reportedly last updated on 19 August 2026. CBP personnel constitute more than half of the dataset, with approximately 10,000 records relating to ICE employees. The archive is described as an internal DHS employee database and was made searchable for public use.
In a statement, the Department of Peace said, “They have our information, so it’s only fair that we have theirs,” highlighting the group’s motivation. The exposure of undercover agents and sensitive operational details heightens security concerns, though the full scope of sensitive information has not been independently verified.
For South African readers, this incident underscores the risks inherent in cybersecurity breaches involving identity management systems within government entities. The potential for large-scale exposure of sensitive personnel data could similarly affect public institutions, law enforcement, and critical infrastructure in South Africa if comparable systems are compromised.
Efforts to confirm the exact method of breach remain ongoing, with no official DHS confirmation yet. Cape Flats News will continue monitoring the story and provide updates as more information becomes available.