The U.S. Department of Homeland Security has suffered a leak of information on 41,000 employees, including undercover agents and coordinates of CBP facilities, while also bringing to light surveillance permission groups tied to Palantir and Grok. The data originated from DHS's Okta login system.

An unprecedented data breach has laid bare the U.S. Department of Homeland Security (DHS). On October 28, the transparency nonprofit DDoSecrets published an archive codenamed "Icepick," containing work records of more than 41,000 DHS employees and contractors—emails, mobile phone numbers, office addresses, internal permission groups, and references to undercover and surveillance programs. The records span DHS headquarters and seven subordinate agencies, including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP), with the most recent update dated August 19, 2026. DDoSecrets and hacker-journalist maia arson crimew previewed the data for Wired, saying it came from a group claiming to have breached DHS; according to DDoSecrets, the source was DHS's Okta login system.

Okta told Wired there is no evidence its own systems were compromised: "Okta is secure, and we have found no evidence of data or system compromise." What is truly unsettling, however, is not whose systems were breached but what the leaked contents reveal: the U.S. homeland security apparatus's heavy dependence on an entire suite of AI and data platforms. Among more than 55,000 permission groups, one can find Palantir's Falcon investigation platform, PenLink for phone and social media analysis, the encrypted messaging app Signal, the facial recognition tool Mobile Fortify used by immigration agents, as well as OpenAI's ChatGPT, Google's Gemini, and Microsoft's Copilot. There is even a group called "Grok.com," containing 8 DHS technical officials. In other words, how the U.S. government weaves AI and surveillance tools into a network has now been laid out on the table.

What Was Leaked: A Battlefield Map of Homeland Security

According to Wired's review of the data, CBP personnel account for more than half of the records. ICE has about 10,000 entries, roughly one-third of which fall under ICE's Homeland Security Investigations (HSI). U.S. Citizenship and Immigration Services (USCIS) has about 6,200 entries, and the Cybersecurity and Infrastructure Security Agency (CISA) has nearly 1,000, more than half of them contractors. More sensitive still are undercover identities: at HSI, 39 employees across more than a dozen field offices belong to permission groups whose names include "CUC" (certified undercover operation). The leak drags these people from "invisible" to "locatable."

That is not all. More than 700 accounts are attached to Signal encrypted communications permission groups, almost all of them CBP personnel; more than 200 CBP accounts belong to the Mobile Fortify facial recognition group, including field supervisors, tactical teams, and intelligence agents. Since Trump signed legislation in July 2025 pledging to expand the ICE enforcement workforce by 10,000 by the end of the year, about 1,300 new ICE enforcement accounts have been created. The records also include nearly 20 Department of Defense personnel, about 170 accounts providing "military processing support" at ICE facilities, 35 explicitly labeled National Guard members, and about 4,400 "affiliated parties"—ranging from IT developers and data scientists to nurses and detention center staff. Most records also include supervisor names, effectively mapping out the entire department's reporting relationships.

Why It Matters: A Textbook Sample for the Intelligence Community

Image source: Wired

Alexander Leslie, a national security expert at threat intelligence firm Recorded Future, put it bluntly: if this data is authentic and current, it is "an extremely valuable intelligence resource for those seeking to infiltrate DHS." Its value lies in correlation—combined with previously leaked information, commercial data, and other intelligence collection, adversaries can follow the supervisor fields to reconstruct the department's internal reporting chain and even identify which individuals hold key permissions. At the time of the leak, DHS was aggressively pursuing its critics: prosecuting demonstrators who exposed ICE officials on social media and expanding the legal definition of "doxing." More than 300 senior HSI agents (including undercover ones) had just participated in an operation, and now their identities sit in a public archive—ready-made targets for anyone seeking revenge or recruitment.

A Chinese Perspective: A Wake-Up Call for Permission Governance and Data Sovereignty

This happened in the United States, but it sounds the alarm for all government and critical infrastructure systems that have moved massively to the cloud and AI. What it exposes is the fragility of "centralized permissions plus platform lock-in": once a login system is dumped, the entire skeleton of the surveillance and law enforcement system is handed over. For China, the corresponding lessons are precisely least privilege, zero-trust architecture, auditable operation trails, and compliance with the principles that "data does not leave the domain and sensitive information is classified"—these are not slogans but hard requirements reverse-engineered from this leak. More broadly, as both China and the United States connect large models to government affairs and security, whoever can put permissions in a cage and make auditing rigorous will hold the foundation of national power in the digital age. The Icepick archive shows that on the proposition of data sovereignty, the level of governance itself is competitiveness.

Today's Quote

"An archive of 41,000 people lays out entirely the U.S. surveillance system's dependence on platforms such as Palantir and Grok. It reminds all government systems moving to the cloud and AI: permission governance and data sovereignty are the true foundation of national power in the digital age."

Follow [Degao Xingzhiqinglang], three hardcore tech analyses every day, to understand the industry and national destiny behind technology.