Hackers broke into a DHS identity system Wednesday1. They walked out with the names, phones and job titles of 41,191 current and former Homeland Security workers3. A nonprofit called Distributed Denial of Secrets put the haul online under one name: Icepick.
WIRED surfaced the detail that gives the leak its edge. Buried inside 55,603 internal group names sit two that most readers would skip past: "HLG PALANTIR" and "Grok.com"63. The first flags staff who log into Palantir's investigative software. Grok.com, the second, lists eight DHS tech staff who use xAI's chatbot, a former chief information officer among them.
A hacktivist group calling itself Department of Peace claims the break-in1. It says it got in through Okta, the login service DHS uses for its own staff. Okta disputes that claim. "Okta is secure, and we have no evidence our data or systems were compromised," the company said4.
Inside the Icepick Archive
The numbers describe a department mapped from the inside out. Records on 41,191 people sit beside 55,603 group names, 6,958 offices and 2,278 locations, some dating back to 20113.
The Icepick Leak Names 41,191 DHS Workers, a Fifth of Its Staff
People named in the Icepick archive against DHS's roughly 220,000 employees and contractors, as of Oct. 28, 2026
DHS's 220,000 figure covers employees and contractors department-wide; the leak's count mixes current and former staff, back to 2011.
Sources: NPR [1]; Unicorn Riot [3]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Named in the leak | 41,191 |
| Rest of DHS's staff | 178,809 |
| Whole | 220,000 |
Customs and Border Protection carries the heaviest share. Its staff and contractors fill 21,329 of the archive's records, more than half the total3. Immigration and Customs Enforcement adds 6,598 more, and its Homeland Security Investigations unit brings 3,421.
CBP Holds More Than Half of the Icepick Leak's 41,191 Names
People named in the Icepick archive, the four DHS components with the most records, as of Oct. 28, 2026
Each bar is one DHS agency's share of the people the leak names; Customs and Border Protection's bar alone passes half the archive's total.
Source: Unicorn Riot [3]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| CBP | 21,329 |
| ICE | 6,598 |
| USCIS | 6,245 |
| HSI | 3,421 |
U.S. Citizenship and Immigration Services staff and contractors run to 6,245 records3. DHS said in a statement that it is "aware of a potential breach and is actively working to address the situation swiftly and effectively"1.
Palantir and Grok Sit on the Org Chart
DHS kept its own list of Palantir and Grok users close, until Wednesday6. The leak did that work for the department.
Other group names point the same direction. "CSA_INTEL_Palantir" sits beside tools built for phone records and surveillance, Palantir's Falcon platform and PenLink among them53.
CyberScoop checked part of the trove against its own files. It found that current staff at the Cybersecurity and Infrastructure Security Agency appear in the records4. That is a sign the leak reaches past old rosters, and into DHS today.
Who Broke In, and Why
Department of Peace named its reason back in March3. Border Patrol agents had killed Renée Good and Alex Pretti in Minneapolis that winter. "I'm releasing this because the DHS is killing us and people deserve to know which companies support them and what they're working on," a spokesperson for the group said at the time.
The group tied Wednesday's release to Secretary Markwayne Mullin by name. "On July 17th, Markwayne Mullin said he was 'turning up the heat.' This is what happens to ICE when you do that," its spokesperson said1.
DDoSecrets founder Emma Best reads the archive for a different reason. "The leak is extraordinary but deceptive in its simplicity, as it identifies the officials responsible for overseeing covert and undercover operations, the government's hunt for leakers and the failed BlueLeaks investigation, along with key personnel in DHS's ever-escalating rendition and deportation programs," Best said4.
WIRED@WIREDNEW: A leak of DHS records has exposed details of more than 41,000 employees and contractors, including workers’ cellphone numbers, ICE and CBP facility locations, and members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot. https://t.co/8LqClojFyU
Naming Names, For and Against
Journalist Ryan Ottignon built the archive's search tool with the hacker known as maia arson crimew1. He answers the doxxing charge directly. "We are in a situation in which a group of public officials go around into cities and states and all around the country, and they seek to hide who they are," Ottignon told NPR.
The hacker crimew, who did the technical build, answers the threats against the project the same way. "I don't think we should let them scare us into not looking into them," she said5.
Ryan Shapiro, executive director of Property of the People, makes the practical case for the release. "Email addresses and phone numbers are indispensable tools for FOIA researchers, often making the difference between a vague records request that gets stonewalled and one that gets results," Shapiro said4.
Alexander Leslie, a national security expert at Recorded Future, answers both of them with a warning. "If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS," Leslie said5. The same sheet an activist uses to file a records request, he argues, can tell a hostile government which officer to target.
CyberScoop's own check already found current staff inside the trove, which answers Leslie's doubt about the data directly4. What stays open is who reads the list next, and what they choose to do with it.
What to Do
Treat this as a live exposure that outlasts a one-day headline, if you handle security or legal risk for your firm. Search icepi.cx, the hackers' own index, for your vendor names and group labels, the way a DHS employee would. Route any match to your incident response team today.
Review which of your internal tools, chat logs or access groups would read the same way if they leaked tomorrow. DHS's Grok and Palantir rosters became news only because the department had kept them from public view.
By the Numbers
- 41,191 people: current and former DHS employees and contractors named in the Icepick archive3.
- 55,603 group names: internal DHS teams and mailing lists inside the leak, Palantir and Grok access rosters included3.
- About a fifth: DHS's roughly 220,000-person workforce has that share named in the archive1.
- 21,329 records: Customs and Border Protection's share of the archive, larger than any other component3.
- Eight officials: DHS tech staff, a former chief information officer among them, sit in the "Grok.com" group3.
- 2011: records in the archive reach back to that year, DHS's own data shows3.
- Secure, Okta says: the company stands by its own systems after the breach claim4.
What to Watch
Watch for DHS to confirm or deny the Okta break-in claim in writing, past the line it gave NPR1. A clear answer would settle Leslie's doubt faster than any outside audit. Watch Congress too: Best's point only lands once a panel actually asks for the files DDoSecrets says it can now unlock4.
Sources
- Vanessa Romo, "Hackers expose the identities of more than 40,000 DHS employees," NPR, Oct. 28, 2026, https://www.npr.org/2026/10/28/nx-s1-6021497/dhs-hack-ice
- David DiMolfetta, "DHS personnel leak exposes contact details and sensitive job information," Nextgov/FCW, Oct. 28, 2026, https://www.nextgov.com/cybersecurity/2026/10/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/416901/
- Dan Feidt, "'Icepick' Leak Exposes Thousands of Homeland Security Personnel, Groups and More," Unicorn Riot, Oct. 28, 2026, https://unicornriot.ninja/2026/icepick-leak-exposes-thousands-of-homeland-security-personnel-groups-and-more/
- Tim Starks, "Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists," CyberScoop, Oct. 28, 2026, https://cyberscoop.com/dhs-employee-data-leak-ddosecrets
- Mezha, "Massive Leak Exposes 41,000 Homeland Security Workers – Including Undercover ICE Agents," Oct. 28, 2026, https://mezha.net/eng/news/mezha-b69007877ebb1d6609473e39_massive_leak_exposes
- WIRED (@WIRED on X), "NEW: A leak of DHS records has exposed details of more than 41,000 employees and contractors," Oct. 28, 2026, https://x.com/WIRED/status/2115546491989176338