Records identifying more than 41,000 U.S. Department of Homeland Security employees and contractors appeared online Wednesday after a hacker using the handle 'Department of Peace' said they pulled the data from an Okta single sign-on system DHS uses to let staff and contractors log into its central network.

The dataset, named Icepick, was posted by the nonprofit leak site Distributed Denial of Secrets with help from journalist and cybersecurity researcher maia arson crimew, who built a public search tool for it.

It includes names, job titles, email addresses, phone numbers, office locations and IT log-in records showing which internal systems each employee can access.

The leak goes beyond a personnel directory: according to The Guardian, the records reference operation names, surveillance programs and previously undisclosed undercover initiatives, including technology from Cellbrite and Palantir.

It also unmasks an agency that aggressively keeps its own agents anonymous — ICE agents frequently work with covered faces and rarely identify themselves, even though U.S. politicians have demanded DHS enforce identification requirements.

Fox News reports it independently confirmed the leaked records include names of several undercover ICE agents working in different parts of the country, and sources described the incident as a 'catastrophic' security breach.

More than 21,000 of the leaked records relate to employees of U.S. Customs and Border Protection, including Border Patrol and staff at airports and ports of entry. Citizenship and Immigration Services, and just under 1,000 employees at the cybersecurity defense agency CISA.

TechCrunch counts the total as about one-fifth of DHS's roughly 220,000-strong workforce, and timestamps on records suggest the data was exfiltrated around mid-August.

The Department of Peace pointed to DHS Secretary Markwayne Mullin's July 17 remark that ICE would be 'turning up the heat on the streets' as motivation.

Multiple outlets verified portions of the dataset.

TechCrunch matched the names of several known DHS employees against an offline copy of the database, and Reuters — cited in The Guardian's reporting — matched personal information of about six named employees to credit bureau and breach data on the dark-web intelligence platform District 4 Labs, then called three DHS employees directly and confirmed their phone numbers.

Okta pushed back on the attack vector, saying in a statement carried by TechCrunch and Reuters: 'Okta is secure, and we have no evidence our data or systems were compromised.'

The breach exposes how DHS is organized: leaked user-group memberships show which agents use surveillance tools, including dozens of groups referencing Penlink, whose technology the company says can track location data of hundreds of millions of mobile devices, and more than 200 CBP users tied to the Mobile Fortify facial-recognition app, per TechCrunch.

Transparency advocates see an investigative windfall — DDoSecrets co-founder Emma Best said the data will 'replace anonymity with accountability' and act as a 'catalyst for investigations,' while Property of the People's Ryan Shapiro told TechCrunch that agent email addresses are 'indispensable tools for FOIA researchers.'

Security experts, meanwhile, note exposed contact data and access maps are prime material for phishing and follow-on attacks.

DHS says it is 'aware of a potential breach' and 'actively working to address the situation swiftly and effectively,' though it is unclear whether the vulnerability has been fixed. Okta says it has no evidence its systems were compromised, leaving open how the exfiltration actually happened.

The leak is the third major U.S. government data disclosure in a month, following ShinyHunters' claimed theft of thousands of FBI employees' records in September and a Pentagon personnel database breach that exposed data on millions of current and former military personnel and prompted a class-action lawsuit.