Major US Homeland Security breach exposes details on 41,000 employees — undercover ICE agents and contractors unmasked in ‘Icepick’ data dump

A significant breach in the United States' Department of Homeland Security (DHS) has unveiled personal information belonging to more than 41,000 employees and contractors. This data leak includes sensitive details about Immigration and Customs Enforcement (ICE) agents, as well as surveillance operations and tools utilized by undercover agents. Numerous high-ranking officials across various US government agencies have been implicated in the breach.

The compromised information encompasses personal data such as email addresses, phone numbers, and office addresses for affected employees, alongside internal data regarding DHS undercover operations and surveillance programs. The leaked archive was published by a self-proclaimed group known as the Department of Peace, who named the leak 'Icepick'.

The Department of Homeland Security has been engaged in a conflict with activists, protestors, and anonymous social media users who have been monitoring and documenting the activities of ICE employees. In response to such protests, the DHS has broadened its definition of "doxing" - the unauthorized disclosure of personal information - to encompass basic details like names.

Maia Arson Crimew, a Swiss cybersecurity researcher and journalist, transformed the leaked data into a searchable database. She maintains that the DHS lacks accountability, despite facing numerous criticisms. For instance, several of their LinkedIn bios merely state "stuff at US Government."

The breach exposed records of approximately 10,000 individuals from ICE, 6,200 from US Citizenship and Immigration Services, and 1,000 from the Cybersecurity and Infrastructure Security Agency. The leaked data includes references to operations like "Keyhole" - an undercover surveillance of Minneapolis protest groups earlier this year - and programs like the Communications Intercept Center TechOps (CICTO), Title III Intercept Program for wiretaps, and Illicit Sensor Intercept Program (ISIP).

Reports also indicate the use of tools such as Palantir’s Falcon investigative platform, the PenLink platform for phone records and social media analysis, and AI platforms like OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot.

According to Distributed Denial of Secrets, a transparency nonprofit that confirmed the leak, the data was obtained from DHS's Okta login system. An Okta spokesperson affirmed that they are aware of the issue and assert that their data and systems remain secure. A DHS spokesperson acknowledged the potential breach and stated that the agency is actively addressing the situation.

They emphasize their commitment to protecting the security of their employees and officers, promising updates on the matter as more information becomes available.