The names and phone numbers made the headlines. The job titles and group memberships are the story: a leaked directory that maps how the Department of Homeland Security organises its surveillance work, and which surveillance tools it uses to do it.
More than 41,000 employee records from the United States Department of Homeland Security have been published online, according to The Verge, citing TechCrunch and Wired. The records carry names, job titles, phone numbers, email addresses and office locations. That alone would be a serious breach. But the leak contains something more revealing than a contact list, and that is why it matters beyond the embarrassment of the moment.
Buried in the data are the department’s internal group memberships: the lists that say who belongs to which team, which unit, and which system they are allowed to use. Read together, those lists sketch an organisational chart of the department’s surveillance work. They show undercover and surveillance work not as an abstraction but as assignments, attached to real teams and real tools.
The numbers, and what sits behind them
About 21,000 of the records relate to staff at Customs and Border Protection, which works at airports and other ports of entry. About 10,000 more relate to Immigration and Customs Enforcement and its Homeland Security Investigations unit combined. Just under 1,000 relate to the Cybersecurity and Infrastructure Security Agency, and thousands more to department headquarters, Citizenship and Immigration Services and the Federal Protective Service. TechCrunch puts the total at about one-fifth of a workforce of around 220,000 people.
The hacker behind the leak uses the handle Department of Peace. According to TechCrunch, the hacker claimed the data was taken from an Okta single sign-on system that lets employees and contractors across the department’s agencies log in to its central network. That claim is contested in an important way: Okta told TechCrunch it is aware of the report and has no evidence its data or systems were compromised. The Department of Homeland Security did not immediately respond to requests for comment from TechCrunch or The Verge.
How the data was actually obtained is therefore still an open question, and it should stay one. What is not in doubt is that the material is now public. It was provided to the journalist and hacker maia arson crimew, who shared a copy with Distributed Denial of Secrets, a nonprofit collective that hosts leaked datasets in the public interest, under the name Icepick. TechCrunch verified a portion of the data by matching the names of known department employees against an offline copy, and reported that record timestamps point to exfiltration around mid-August. An analysis by Wired reported the records were last updated on August 19, 2026.
A directory that knew too much
Every large organisation has a directory. The difference here is what this directory recorded. The leaked data includes membership in user groups within the department’s Active Directory, the system that controls access to internal tools, services and third-party offerings used for work. Those groups offer a partial view of where an agency’s work is concentrated, because they are written for administrators, not for the public.
Most employees in the dataset belonged to the group for Microsoft 365, the cloud service that hosts the agency’s emails and files, along with groups for ordinary desktop software such as Adobe Acrobat and Citrix. The revealing part sits at the edges.
Group names in the data describe undercover operations, covert operations, special operations and surveillance work, along with computer forensics, according to Reuters reporting. A Wired analysis counted more than 55,000 internal permission groups in the archive, referencing undercover operations, wiretap programmes, Palantir’s Falcon platform, PenLink and the Mobile Fortify facial-recognition app.
The surveillance tools in the margins
Two tool names recur, and they explain why this leak reads differently from a simple exposure of contact details. PenLink, described in the reporting as a surveillance tool that collects and analyses data from phones and online services, appears in the group listings, including one group with more than 2,000 users across ICE’s Homeland Security Investigations unit.
Mobile Fortify, a facial-recognition app used by both Customs and Border Protection and ICE agents, is associated with more than 200 Customs and Border Protection users in one group. Around 4,500 users, including ICE agents and deportation officers, belong to a group for Headspace; Headspace said it has not provided any services to the department or ICE since 2023.
Other groups point to ChatGPT access, including for senior department officials, and to investigations into the hacking groups known as Salt Typhoon and Volt Typhoon. None of this proves what any individual did with any tool. Group membership is a listing, not a logbook. But as a map of which units are connected to which capabilities, it is unusually detailed, and it was never meant for outside eyes.
The silence, and the symmetry
The hacker left a note with the data, seen by TechCrunch, reading: “They have our information, so it’s only fair that we have theirs.” The line is glib, and it should not be mistaken for a justification. But it captures the symmetry at the heart of this story: a department whose internal groups map surveillance work has now had that map published.
That symmetry cuts both ways. Publishing work contact details and role assignments for enforcement staff creates real personal-safety risks, especially for people in undercover roles. A directory dump proves membership and access listings, not wrongdoing by any individual named in it. Treating every name in the file as a villain would be guilt by association.
There is also a narrower, more defensible case for why the material matters to the public. Transparency advocates argue that email addresses and phone numbers are practical tools for public-records requests, and that more targeted requests could aid investigations. Emma Best, co-founder of Distributed Denial of Secrets, described the data as a catalyst for investigations, congressional inquiries, legal challenges and freedom-of-information requests. Whether that promise materialises depends on what journalists and lawyers do next, not on the leak alone.
What remains unknown
Several basic questions are still unanswered. It is unclear whether the vulnerability that allowed the breach has been fixed, or whether the department was aware of the theft before publication, according to TechCrunch. It is unclear whether the group memberships reflect current access or include historical listings. And the mechanism itself remains disputed: the hacker’s Okta claim against Okta’s statement that it has no evidence its systems were compromised, with the department silent so far.
Context sharpens the stakes without settling them. TechCrunch notes this is the second breach involving the department this year attributed to the same hacker, who previously claimed to have taken thousands of contracts between the department and the private sector. It follows recent hacks involving the theft of FBI personnel records and personal information from the Pentagon’s human-resources unit. What links these incidents in the reporting is their timing, not a demonstrated common cause.
That is the real story of the Icepick leak. A phone book can be reprinted. These listings show assignments and tool links, and they are now public. The argument over what to do with them has only just begun.
