A hacking group cracked the U.S. Department of Homeland Security's personnel files, exposing the names, phone numbers and addresses of more than 40,000 DHS agents, operatives, and associates, on Wednesday, including those involved in undercover operations.
"On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," a spokesperson for the hacktivist group behind the breach, the Department of Peace, said in an online statement.
The hackers said they stole the data by subverting DHS's single sign on system, according to an online post. It said it distributed that material to the group Distributed Denial of Secrets, which posted it online in a database called Icepick. The Department of Peace also shared the trove of data with Ryan Ottignon, a U.S.-based journalist, and a Swiss activist known as maia arson crimew. Together, the two created a searchable online database, with crimew doing all of the technical work, Ottignon told NPR.
DDoSecrets cofounder Emma Best called the leak "extraordinary but deceptive in its simplicity," because it makes explicit connections between "officials responsible for overseeing covert and undercover operations …along with key personnel in DHS's ever-escalating rendition and deportation programs."
Other activists say the information will be a boon to those investigating DHS and filing freedom of information requests, which, due to a lack of specific information, like names, email addresses, can often yield useless results.
In a statement, DHS said it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." The department added that it is taking necessary steps to "ensure all are properly protected."
More than 21,000 records identify employees with U.S. Customs and Border Protection. Another 10,000 relate to Immigration and Customs Enforcement employees and its Homeland Security Investigations unit.
It is an unprecedented breach of intelligence, coming on the heels of similar hacking attacks at the FBI. However, the database is far from comprehensive and represents about a fifth of Homeland Security's workforce, which staffs a little more than 220,000 people.
Ottignon, who has worked on similar data leak projects in the past, rejected suggestions that he and others connected to the Department of Peace or Distribution Denials of Secrets were doxing government employees.
"We are in a situation in which a group of public officials go around into cities and states and all around the country, and they seek to hide who they are. Very frequently using masks, wearing plain clothes. And they do universally unspeakable things to these communities," Ottignon said. He added that he believed that kind of behavior is unacceptable in a free society.
"We need oversight for useful government, if it exists at all. So this is just one step in that oversight process," he added.
In a note attached to the files, the Department of Peace wrote, "They have our information, so it's only fair that we have theirs."
Transcript
LEILA FADEL, HOST:
Hackers have exposed the identities of tens of thousands of Department of Homeland Security employees. That includes their names, email addresses and phone numbers. NPR immigration correspondent Vanessa Romo is covering this and joins me now. Good morning, Vanessa.
VANESSA ROMO, BYLINE: Good morning, Leila.
FADEL: So tell us about the scope of this breach.
ROMO: Well, this is a massive breach of intelligence for the government. So there is a lot of information out there. The stolen data set includes contact information for more than 41,000 DHS agents, operatives and associates, including those involved in undercover operations. And of those, more than 21,000 records identify employees with U.S. Customs and Border Protection.
Another 10,000 unmask the identities of Immigration and Customs Enforcement employees and people in Homeland Security Investigations units. And about 1,000 show people who work for the cybersecurity defense agency. That and all - a ton more are available in a searchable database. But the really interesting thing about the way the online tool works is that every personnel file includes the names of supervisors and direct reports. So you can actually follow the chain of command, which we haven't been able to see before in such an explicit way.
FADEL: A lot of information there. How did the hackers get ahold of it?
ROMO: A group of hacktivists calling themselves the Department of Peace said that they obtained the data by subverting DHS' single sign-on system. They then handed all of that raw data over to a group called Distributed Denial of Secrets - or DDoS - which partnered with a Swiss activist who goes by maia arson crimew. And that's who actually created the searchable website that's now available to the public.
FADEL: And did they say - these hackers say why they did this?
ROMO: In a note that was attached to the data, the Department of Peace basically said that it was to level the playing field. They said, quote, "they have our information, so it's only fair that we have theirs." Meanwhile, DDoS and other activists involved said that they did it as a public service so that anyone who was investigating the department can file more complete freedom of information requests.
FADEL: What about the argument that this can put ICE officers and others in danger?
ROMO: I spoke to Ryan Ottignon, a journalist who worked with the Swiss activist, crimew, to build that searchable database. And he pushed back on that idea that this was doxing.
RYAN OTTIGNON: We are in a situation in which a group of public officials go around the country, and they seek to hide who they are, very frequently using masks, and they do universally unspeakable things to these communities.
ROMO: He's referring to ICE shooting and killing Americans and noncitizens.
FADEL: Now, DHS has been aggressive about protecting ICE agents' identities. What has it said about the hack?
ROMO: So in a statement, DHS officials said the department was, quote, "aware of a potential breach and is actively working to address the situation swiftly and effectively." They also said that they're taking necessary steps to ensure that everyone is properly protected. And as you mentioned, the Trump administration has pushed back against people publicly naming ICE agents and has regularly said that those who dox ICE officers will be prosecuted to the full extent of the law.
FADEL: That's NPR's Vanessa Romo. Thank you, Vanessa.
ROMO: Thank you, Leila.
Correction
Oct. 29th, 2026
A previous version of this story misattributed the quote, "They have our information, so it's only fair that we have theirs," to the DDoS. It was written by the Department of Peace.