A hacktivist group has published records identifying more than 40,000 people associated with the US Department of Homeland Security, including personnel linked to undercover work, according to NPR. The exposed material includes names, phone numbers and addresses, creating safety and privacy risks for employees and associates named in the files.
The group calling itself the Department of Peace claimed it obtained the information by compromising DHS's single sign-on system. That account has not been independently established in the supplied evidence. DHS told NPR it was aware of a potential breach and was working to address it, adding that it was taking steps to protect affected people.
The records were passed to Distributed Denial of Secrets, a transparency collective that published them in a database named Icepick. The hackers also shared the material with US journalist Ryan Ottignon and Swiss activist maia arson crimew, who created a searchable version. NPR reported that more than 21,000 entries identify Customs and Border Protection personnel, while about 10,000 relate to Immigration and Customs Enforcement and its Homeland Security Investigations unit.
The data set is large but incomplete. DHS employs slightly more than 220,000 people, making the published records roughly one-fifth of its workforce. The inclusion of people involved in covert or undercover functions raises the stakes beyond a conventional personnel-data leak, because combining workplace roles with personal contact information can expose individuals to harassment or targeted attacks. NeoTechNews is not linking to or reproducing the database.
People involved in publishing the data argued that identifying public officials enables oversight and more precise freedom-of-information requests. Ottignon rejected the characterization of the project as doxing and said the public should be able to identify officials exercising government power. That view is disputed: releasing home addresses and phone numbers can endanger individuals regardless of whether some names or job titles might otherwise be obtainable through public records.
The incident also illustrates why the method of access matters. If the attackers' single-sign-on claim is confirmed, investigators will need to determine whether credentials, session tokens or another weakness enabled entry, what systems were reached and whether the published files represent the full extent of the compromise. A personnel breach can require password resets, identity monitoring, access reviews and protective measures for people in sensitive roles.
DHS's statement did not confirm the hackers' technical account or provide a detailed scope. Until the department completes its investigation, the attribution, precise intrusion path and completeness of the stolen material remain uncertain. What is clear from the published reporting is that a substantial set of personnel information has circulated outside government control, and the response must address both the security failure and the risks faced by those identified.
