You might think an employee directory sounds pretty harmless. After all, most workplaces keep lists of names and phone numbers so people can reach one another. But what happens when that information belongs to thousands of federal agents, including people connected to undercover investigations?
A massive Homeland Security data leak has exposed records involving more than 41,000 employees and contractors. The information includes contact details, office locations and internal access groups tied to sensitive government operations. Some records even point to surveillance programs and artificial intelligence tools used within the Department of Homeland Security (DHS).
Now, federal officials are scrambling to contain the fallout as concerns grow over the safety of agents and their families. And there’s a bigger cybersecurity lesson here that applies well beyond Washington.
Missed CyberGuy LIVE? Watch the replay and discover 5 ways to travel smarter and save money.
Our free CyberGuy LIVE class, 5 Ways to Travel Smarter and Save Money, has ended, but you can still watch the full replay. Kurt “CyberGuy” Knutsson walks you through five practical ways to protect your phone and personal information, avoid common travel scams, find better deals, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Watch the free replay + downloadable checklist now at CyberGuyLive.com.
On Oct. 28, the nonprofit Distributed Denial of Secrets published a collection of DHS records under the name Icepick. The information reportedly came from a group calling itself the Department of Peace, which claims it obtained access to internal government systems. The records reportedly cover DHS and seven of its component agencies, including Immigration and Customs Enforcement (ICE) and U.S. Customs and Border Protection (CBP).
The files contain employee names, agency email addresses and workplace locations. They also include phone numbers, some identified as cell phone numbers, along with supervisors and internal access-group memberships. However, it has not been established that employees’ private home addresses were included. CBP accounts for more than half the records, while roughly 10,000 involve ICE. Another 6,200 are tied to U.S. Citizenship and Immigration Services. The records were last updated on Aug. 19, so some assignments may have changed. That’s an enormous amount of organizational information to have floating around publicly. And the deeper researchers looked, the more sensitive the findings became.
One of the most alarming findings involves internal groups associated with undercover investigations. WIRED identified 39 Homeland Security Investigations employees connected to access groups referencing certified undercover operations. Other groups reference communications interception programs and surveillance technology. The files also reveal reporting relationships that could help someone understand how different parts of DHS work together.
That raises a difficult security concern. People conducting undercover investigations depend on keeping certain relationships and assignments confidential. Revealing those connections could create risks for ongoing operations. Still, membership in an internal access group does not automatically confirm that every person listed was working undercover. The leaked records offer clues about sensitive assignments, but they don’t establish every individual’s operational role. Former acting ICE director John Sandweg called the exposure a “nightmare scenario”. He warned that revealing agents’ identities could put people in danger and interfere with criminal investigations.
Here’s another part of this story that caught my attention. The leaked records reveal internal access groups referencing technology used for investigations and government operations. Some groups mention Palantir’s Falcon investigative platform, which helps investigators analyze information. Others reference surveillance-related software, including tools used to examine phone records.
Then there’s artificial intelligence. WIRED found groups mentioning OpenAI’s ChatGPT, Google’s Gemini and Microsoft’s Copilot. One group labeled “Grok.com” included eight DHS technology officials. That doesn’t prove these employees actively used the services or that the technology companies experienced breaches. The group names can reflect access permissions rather than actual activity. Even so, the information offers outsiders a closer look at the technologies DHS personnel may have access to. For an agency responsible for national security, those internal details can be valuable to people looking for weaknesses.
FBI SAYS SOURCE OF ITS JOBS PORTAL BREACH STILL UNKNOWN AS HACKERS ALLEGE EMPLOYEE DATA COMPROMISED
The group claiming responsibility says it accessed the information through DHS’s Okta sign-in system. Okta provides identity and access-management technology that organizations use to control employee logins. However, Okta says it has no evidence that its own systems or data were compromised. That leaves the actual entry point unresolved.
DHS has acknowledged a potential breach and says it is investigating. The department has not publicly confirmed how the information was obtained. It’s also important to understand what has been established so far. The reporting centers on personnel information and access-group details. It has not confirmed that employee passwords, intercepted communications or investigative case files were included. Until investigators explain what happened, there’s no reliable basis for blaming a specific vulnerability or software provider.
We reached out to the Department of Homeland Security and Okta for additional comment. A DHS spokesperson provided the following statement: “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” Okta had not responded to our request for additional comment by our deadline.
As the records spread online, DHS moved to limit access. On Oct. 29, a company reportedly authorized to seek content removals on behalf of ICE contacted Icelandic hosting provider FlokiNET. The request warned that the database exposed more than 40,000 identifiable individuals to potential harassment and physical harm. However, the hosting company declined to remove the material, saying the records contained workplace contact information rather than private home contact details.
The database briefly became inaccessible before appearing again elsewhere. Then, on Oct. 30, SITE Intelligence Group had reportedly identified threatening online rhetoric following the release. Some social media users reportedly threatened immigration officers and their families. Those reports raise additional concerns about what happens after sensitive personnel information becomes searchable. Even if the original files disappear, copies may already exist elsewhere.
You might be wondering why a federal employee database should concern someone who works in an office, owns a small business or has nothing to do with immigration enforcement. Think about how a convincing scam works. Someone contacts you claiming to be from your company’s IT department. They know your supervisor’s name and your work email address. They even mention an internal system you’re familiar with. Suddenly, that unexpected message sounds a lot more believable.
That’s the danger when attackers combine workplace records with information they find elsewhere online. They can use those details to create personalized phishing messages or impersonate trusted colleagues. We’ve seen related concerns before. In our reporting on the FBI hack claim involving sensitive personnel data, we examined how employee information could expose individuals and their families to additional risks. And that’s what concerns me about this latest incident. Even information that seems routine can become dangerous when someone connects it to other records.
You may have no control over how your employer stores its records. However, there are ways to reduce the amount of personal information available about you and make targeted scams harder to pull off.
If someone contacts you claiming to be from your employer’s IT department, don’t assume they’re legitimate because they know your name or job title. Contact your IT department using a phone number or communication channel you already trust. Avoid clicking links in unexpected password-reset emails, especially when the message creates urgency. A convincing message can still lead to a fake login page designed to steal your credentials.
Your primary email account deserves special attention because criminals may use it to reset passwords for other services. Use a strong, unique password for every important account and consider a reputable password manager to create and store them. Turn on multifactor authentication or passkeys wherever available. Also review your recovery email addresses and phone numbers to make sure nobody has changed them without your permission.
Once criminals have detailed information about you, they may send phishing messages containing malicious links or infected attachments. Strong antivirus software can provide an additional layer of protection by helping detect malicious downloads, known phishing websites and malware before they cause damage. Keep your operating system and security software updated so you receive the latest protections. Antivirus software cannot remove your information from a leaked database. However, it can help protect your devices against attacks that may follow an exposure. No security tool catches every threat, so continue checking unexpected messages carefully. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
Here’s something I strongly recommend considering. Data brokers collect personal information from public records and online sources. That information can include your home address, personal phone number and details about relatives. When someone already has your workplace information, finding additional personal details may make harassment or impersonation attempts easier. A reputable data removal service can help remove your personal information from participating data broker and people-search websites. Services such as Incogni automate removal requests and continue checking for information that reappears. You can also contact individual data brokers yourself, although that takes more time and ongoing follow-up. Keep in mind that these services cannot guarantee removal from every website or erase the original DHS leak. For more information, see our guide on how to remove your personal information from the web and keep it from coming back. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
Search your own name and see what appears. You may discover old professional profiles, forgotten social media accounts or websites showing personal contact details. Check the privacy settings on your social media accounts and limit how much information strangers can see about your family. Be especially careful about publicly revealing your home location or daily routine if you work in a sensitive position. If you discover unwanted personal information online, contact the website or platform and request removal where possible.
The reported DHS records center on workplace information. So far, there has been no confirmation that Social Security numbers or financial account details were included. Still, exposed contact information can help criminals build more convincing scams. Monitor your important accounts for unfamiliar activity and pay attention to suspicious password-reset messages. If you discover that sensitive identity information has been compromised elsewhere, consider freezing your credit with Equifax, Experian and TransUnion. Identity monitoring services may also help flag certain signs of fraud. However, they cannot prevent every type of identity theft or guarantee that your information will stay private. See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.
If someone uses your workplace information to impersonate a colleague or threaten you, document what happened. Save relevant emails, screenshots and messages, then report the incident to your employer’s security team. If you receive threats of violence, contact law enforcement. You can also report suspected internet crime through the FBI’s Internet Crime Complaint Center at ic3.gov/. If you’re an employee whose information may be involved in a breach, ask your employer whether you were affected and what protective steps it recommends. Don’t rely on unsolicited callers claiming they can verify your exposure.
What strikes me about this Homeland Security leak is how much damage a collection of workplace records could potentially cause. We’re talking about information that many organizations use every day to help employees do their jobs. Yet in the wrong hands, those same details can help identify people involved in sensitive operations or make targeted scams much more convincing. I also believe there’s an important conversation to be had about government transparency. Americans have a right to question how federal agencies operate and how officers are held accountable. But I worry about the consequences when information tied to undercover personnel becomes publicly searchable, especially now that threats against employees and their families have been reported. For me, the biggest unanswered question is how DHS allowed this information to become exposed in the first place. The department needs to explain what happened and how it plans to prevent another incident. In the meantime, there’s a lesson here for all of us. Pay attention to how much personal information is available about you online. You may never be able to remove everything, but reducing your exposure can make it harder for someone to target you.
Do you believe exposing the identities of federal agents is justified in the name of government transparency, even when it could put undercover operations and employees’ families at risk? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.
