41,000 Homeland Security staff are now searchable. The hackers call it 'only fair'

The Department of Homeland Security has spent much of this year getting better at finding people. This week a lot of people went looking for DHS.

On Wednesday the transparency collective Distributed Denial of Secrets (DDoSecrets) published a dataset it calls Icepick. It holds names, job titles, office locations, work email addresses and phone numbers for more than 41,000 DHS employees and contractors. The hacker behind it goes by "Department of Peace" and handed the files to DDoSecrets and to the Swiss hacker and journalist maia arson crimew, who built a search site on top of them. The group's explanation, as quoted by NPR, fits in one line: "They have our information, so it's only fair that we have theirs."

The group tied the timing to a July 17 remark by DHS Secretary Markwayne Mullin about "turning up the heat." It is the same hacker's second DHS breach this year, according to TechCrunch.

What's actually in it

Customs and Border Protection makes up the biggest slice. TechCrunch counted about 21,000 CBP records, about 10,000 for ICE and Homeland Security Investigations, just under 1,000 for the Cybersecurity and Infrastructure Security Agency, and thousands more for headquarters and smaller offices. The BBC, counting ICE alone, got nearly 6,600. WIRED estimated the whole thing covers about a seventh of the DHS workforce. Timestamps suggest the data was taken around mid-August.

A staff directory on its own is dull. What makes Icepick interesting is the permission groups, the internal mailing lists and access roles that say what each person can touch. WIRED found more than 55,000 of them. Among the details it pulled out:

• 39 HSI employees sit in groups with "CUC" in the name. Government court filings use that abbreviation for a certified undercover operation.
• More than 200 CBP accounts belong to a group referencing Mobile Fortify, the face recognition app.
• A group called "Grok.com" includes eight DHS technology officials.

TechCrunch also found groups referencing Penlink, a company that sells web surveillance tools, and about 4,500 users in a group called "Headspace_users." Headspace told TechCrunch it hasn't provided services to DHS or ICE since 2023. So somebody's group memberships are out of date, which tells you something about how tidy this directory was.

The hacker says the records came out of the Okta single sign-on system DHS uses for staff and contractors. Okta's answer: "Okta is secure, and we have no evidence our data or systems were compromised." Both can be true. A customer's login setup getting raided is a different event from the vendor getting breached, and nobody has said publicly which this was.

Is it real?

Mostly, as far as reporters can tell. Reuters couldn't verify the whole trove but matched the details of six named employees against credit bureau and breach records, then phoned three of them. All three confirmed their details. One said it was the first they had heard of any breach. TechCrunch checked names of known employees against its own offline copy. Nextgov/FCW found parts of the data are stale, listing CISA staff who have already left.

DHS gave the line agencies give: "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." It also moved faster than that sentence suggests. According to TechCrunch, DHS sent a takedown notice through the security firm ZeroFox, asking the domain registrar to stop serving "personal contact and location data of individuals who did not consent to its publication."

That phrase is doing a lot of work for an agency whose staff, per its own leaked groups, have access to a face recognition app.

The pressure worked, at least on the easy targets. Crimew's search site went offline on Thursday after its registrar, CentralNic, put the domain on hold. CentralNic didn't say whether it was acting on the government's demand. Bluesky started blocking links to the DDoSecrets archive and labeling them "malicious," saying the files contain contact details shared without authorization. The archive itself was still up at the time of writing.

Business card or target list

The two most useful quotes on this came from people who disagree. Alexander Leslie, an analyst at Recorded Future, told reporters: "If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS." Adam Steinbaugh of the free speech group FIRE took the other side: "This is information that would be on a business card." He added that publishing it isn't something the government can criminalize.

DDoSecrets co-founder Emma Best says the set has no home addresses or personal contact details. Crimew pitched it as research material, saying it will provide "FOIA material for years to come." Records requests often live or die on knowing exactly which office and which person to ask, and Icepick answers that for tens of thousands of desks.

It also lands in a bad autumn for federal personnel data. In late September the ShinyHunters crew claimed it had taken FBI employee and applicant records from the bureau's job portals. In early October the Pentagon's Defense Manpower Data Center started notifying more than 3 million people that their data, Social Security numbers included, had been accessed.

Steinbaugh is right that every single row is business card material. But nobody hands out 41,000 business cards at once, sorted by city, with a note on the back saying which ones work undercover.

Sources: WIRED, TechCrunch, Reuters, The Next Web, Help Net Security, NPR.