Homeland Security Icepick Leak Lays Bare Undercover ICE Links and Internal AI Access Groups

A data leak involving records linked to more than 41,000 Department of Homeland Security (DHS) employees and contractors has exposed contact details and internal organisational information, raising concerns about the security of personnel and sensitive operations.

The unprecedented data dump exposes structural frameworks spanning DHS and seven component agencies, including US Customs and Border Protection and Immigration and Customs Enforcement (ICE).

The hackers reportedly claimed to have obtained the records through DHS's Okta sign-on service, although the precise method of access has not been independently established.

The archive, published on Wednesday by the transparency nonprofit Distributed Denial of Secrets (DDoSecrets) under the name 'Icepick,' was obtained from a hacktivist group calling itself the Department of Peace.

The dataset provides a partial picture of DHS's organisational structure, including reporting relationships and groups associated with sensitive operations. Its publishers have cautioned that the database may be incomplete and contain inaccuracies.

By laying bare administrative hierarchies, reporting pipelines, and digital clearances, the leak raises operational security concerns.

Unveiling Undercover ICE Operations

The dataset reportedly includes around 10,000 ICE-related records, including information that may help identify personnel associated with undercover operations. The leaked directory goes far beyond basic corporate rosters by revealing phone numbers, email strings, office addresses, and complex reporting relationships.

The data also exposes specific groups that dictate which employees have access to covert activities. This administrative mapping could enable observers to cross-reference names with internal permission groups, potentially identifying personnel linked to undercover operations.

The information could help hostile actors identify personnel linked to sensitive operations or develop targeted impersonation attempts, potentially placing investigations at risk.

AI Tools and Surveillance Systems Identified in Leak

Aside from individual identities, the leaked directory references wiretapping programmes and permission groups named after commercial AI platforms, including ChatGPT, Gemini, Copilot and Grok.

By identifying employees associated with these permission groups, the leak could help foreign intelligence agencies and cybercriminals develop targeted impersonation attempts. Adversaries could use the information to craft spear-phishing messages resembling routine security alerts from technology providers, aiming to steal federal users' credentials.

The reported group memberships do not establish that personnel uploaded sensitive operational data or agency code into these tools, or that the providers' systems were compromised.

Hackers' Message and Official Response

Alexander Leslie, a national security expert, told Wired: 'If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,' warning that adversaries could use it to 'identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.'

The hackers delivered a blunt ideological message alongside the files. It said, 'They have our information, so it's only fair that we have theirs.' DDoSecrets said the files came from DHS's Okta sign-on service.

Okta defended its platform's integrity, stating, 'Okta is secure, and we have no evidence our data or systems were compromised.'

Okta said it had no evidence that its own systems or data had been compromised. That statement does not establish how the records were obtained, and the precise access method remains unconfirmed.

DHS said it was aware of a potential breach and was working to address the situation and protect its personnel.