On October 29, 2026, Bloomberg Law reported that the identities of more than 40,000 employees of the US Department of Homeland Security had been published online — roughly 15 percent of the department's entire workforce. Names, phone numbers, email addresses and field office assignments, released in one searchable dump for anyone to browse.

The publisher is Distributed Denial of Secrets, the leak site known for collecting and releasing massive datasets. It says the material came from an entity calling itself the "Department of Peace". The dataset, distributed under the name "Icepick", covers staff across Immigration and Customs Enforcement, Customs and Border Protection, US Citizenship and Immigration Services, the Federal Law Enforcement Training Center, the Cybersecurity and Infrastructure Security Agency and the Federal Protective Service.

What's in the data — and why the undercover roles are the dangerous part

Contact details are only half the story. The dump also contains job titles and internal email groups, and those reveal which agents are assigned to special operations, surveillance, human intelligence, computer forensics and undercover work. In other words, this is not just a staff directory — it is a partial map of how the department's sensitive operations are staffed.

This is the detail that changes the severity of the whole incident. A leaked staff directory is embarrassing; a leaked map of who does undercover work is operational damage. For an undercover agent, a name linked to a phone number and a field office can end a years-long operation — or put a life at risk. Criminal networks, cartels and foreign intelligence services now have a searchable roster of the people investigating them. That is the part of this leak no password reset can undo.

Who leaked it: Distributed Denial of Secrets and the "Department of Peace" claim

Distributed Denial of Secrets is a nonprofit transparency group with a long history of publishing large leaked datasets. It says the DHS material was obtained by a hacktivist entity calling itself the "Department of Peace", which claims it compromised the department's single sign-on system to get the records. Okta, the identity provider named in some reporting, has said it has no evidence its systems were compromised — so the exact intrusion path is still disputed. The data was made searchable through a tool built by the hacker known as maia arson crimew.

A note of caution belongs here, because it matters for how you read every leak story: treat the "Department of Peace" attribution for what it is — the leaker's own chosen name, unverified. It could be a real group, a joke, or a false flag. What is verified is the dataset itself, with multiple outlets independently confirming entries. In leak analysis, the provenance story is interesting, but the data is the evidence.

DHS responds

The department's statement was brief: it is "aware of a potential breach and is actively working to address the situation swiftly and effectively", working to protect its employees and promising public updates when more information is available.

Note the word "potential". DHS has not publicly confirmed the full scope of what was taken, which is standard incident-response language while an investigation is still open — but it also means the confirmed picture may still grow. When an agency confirms only a "potential" breach after 40,000 of its people's identities are already searchable online, read it as an investigation in progress, not a final assessment.

The pattern: the third US government leak in a month

This did not happen in isolation. In September, the hacking group ShinyHunters claimed the theft of a massive trove of data from the Federal Bureau of Investigation, including sensitive job details and medical information. Last week, the Defense Department was hit with a class-action lawsuit after a breach exposed data on millions of current and former military personnel. Now the Department of Homeland Security.

Three incidents, three agencies, one month. This is no longer a string of isolated breaches — it is a pattern of America's federal personnel data being harvested and dumped in public. Whether one actor or several is behind it, the effect compounds: the people tasked with national security are being catalogued, and every new dump makes the next round of targeted phishing, impersonation and recruitment attempts easier to run.

What this means

For the 40,000-plus people exposed, the immediate threat is not abstract. Verified names, phone numbers and work emails in unknown hands means targeted phishing — "DHS IT needs you to verify your credentials" — impersonation, and doxxing. The families of federal agents sit inside the blast radius too.

For undercover personnel, the worst case is operational compromise that cannot be patched. You can rotate a password; you cannot un-publish an agent's cover.

For everyone else, the lesson is structural. Personnel directories are high-value targets, and the US government's own house keeps getting robbed. If the Department of Homeland Security cannot keep its own roster out of public hands, then every organization holding a staff directory — every company, every agency — should be asking how theirs is protected, who can export it, and whether anyone would notice.

One practical note: if you work in government or law enforcement, treat unexpected calls, emails or "verification" requests with suspicion for the foreseeable future, and confirm anything sensitive through official channels you already trust — not through contact details in the message itself.

Key takeaways

  • More than 40,000 DHS employees — around 15 percent of the department — were exposed: names, phone numbers, email addresses and field office assignments, reported by Bloomberg Law on October 29, 2026.
  • Components in the data include ICE, Customs and Border Protection, USCIS, the Federal Law Enforcement Training Center, CISA and the Federal Protective Service.
  • The dangerous part is operational: job titles and email groups reveal agents assigned to special operations, surveillance, human intelligence, computer forensics and undercover work.
  • The dataset, distributed as "Icepick", was published by Distributed Denial of Secrets, which attributes the source to an entity calling itself the "Department of Peace" — a claim that remains unverified, as does the exact intrusion path.
  • DHS says it is "aware of a potential breach and is actively working to address the situation swiftly and effectively" — careful language that leaves room for the confirmed scope to grow.
  • This is the third major US government personnel leak in a month, after the claimed FBI trove theft by ShinyHunters in September and the Defense Department breach now facing a class-action lawsuit.

Sources and scope

Figures in this article follow reporting by Bloomberg Law on October 29, 2026 and The Economic Times. The same facts are corroborated in the Reuters wire account: Leak website releases data on thousands of US Homeland Security employees. Three scope notes: the "around 15 percent" figure is as reported and depends on the department's total headcount; the "Department of Peace" attribution and the single sign-on intrusion claim come from the leakers via Distributed Denial of Secrets and are unverified — Okta has denied its systems were compromised; and DHS has so far confirmed only a "potential breach", so the official scope may be updated. Cover photo: the US Capitol dome, photo by Eleven Photographs on Unsplash.