Homeland Security moved on Thursday to pull the leaked personnel data off the internet — and the Icelandic company hosting it refused. Acting through ZeroFox, a security firm Immigration and Customs Enforcement has authorised to pursue content removals, the department wrote to the hosting company FlokiNET asking it to “remove or disable” a dataset it called stolen. The database, the request said, “places more than 40,000 identifiable individuals at risk of harassment, stalking, and physical harm”. FlokiNET published the letter and declined.
The host's answer rests on what the data is. FlokiNET's chief executive, Kolja Weber, said the company would not remove the data because the records hold government employees' work addresses and work phone numbers — not personal phone numbers and addresses. In its own statement, the company put the principle plainly: “Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out.” The site, it says, publishes work identities — who the employees work for, what their role is and how they can be reached in that role — and functions as a reference tool for accountability reporting by journalists and citizens.
The pressure did land in one place. The registrar behind the search site's original address, icepi.cx, placed the domain on hold on Thursday morning, and the site stopped loading. It did not stay down: the searchable database was back online the same day at a new address, still hosted by FlokiNET, and the full archive remains on the leak site that published it. The social platform Bluesky took a different step, blocking links to the leak site as malicious while leaving in place the posts that carried them.
The fight is over data released a day earlier.
A leak website has published data on more than 40,000 Department of Homeland Security employees, laying out names, phone numbers, job titles and assignments across the department — including officials in surveillance and human intelligence — in one of the largest exposures of federal employee information ever.
Distributed Denial of Secrets, a nonprofit transparency group that hosts leaked datasets, released the material on Wednesday under the name “Icepick”. The group says the records identify 41,191 employees and contractors, and it has made them searchable: anyone can type in a name, an office or a job title and pull up the entry in seconds. The records cover about a fifth of the department's 220,000-strong workforce.
What is in the release is not case files or intelligence reports. It is the department's own internal directory — what makes it dangerous. For each person it can include a name, a job title, a work email address, a cell phone number, an office location and a supervisor's name. Attached to many entries is something more sensitive still: the internal permission groups each employee belongs to — more than 55,000 of them — which show who may use which of the department's systems and tools.
Those group names spell out work the department does not advertise: which agents are assigned to special operations, surveillance jobs, computer forensics and undercover work. Dozens of Homeland Security Investigations employees sit in groups whose names include “CUC”, which court filings say stands for “certified undercover operation”. Others reference a wiretap programme, a communications intercept centre and an illicit sensor intercept programme, plus the surveillance tools agents can reach — a facial-recognition app, a platform that analyses phone records and social media, and phone-extraction technology. The data also names dozens of previously unknown operations, and the agents who led them.
More than half of the records — about 21,000 — belong to Customs and Border Protection. About 10,000 more cover Immigration and Customs Enforcement and its Homeland Security Investigations unit, 6,200 cover Citizenship and Immigration Services, and just under 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, the department's own cyber defence arm.
The group says the data was taken from the Okta sign-on service the department uses to log employees in to its systems, and timestamps in the records indicate the directory was exported around mid-August — the theft sat undisclosed for roughly two months. That account is a claim, not a finding. Okta says its own house is in order: “Okta is secure, and we have no evidence our data or systems were compromised.” Whether the hole the data walked out of has been closed, nobody has said.
News organisations that examined portions of the data found it checked out. Wire reporting matched details for six named employees against outside records and confirmed phone numbers by calling three employees directly. One of the three said it was the first they had heard of any breach. Other checks verified serving cybersecurity agency employees in the records. The full trove has not been authenticated entry by entry, and no passwords, Social Security numbers or home addresses have been reported as part of it.
The entity behind the theft, which calls itself Department of Peace, made no secret of its motive. In a statement included with the data it said department employees “have our information, so it's only fair that we have theirs”, and a spokesperson tied the release directly to the Secretary of Homeland Security's pledge in July to turn up the heat on immigration enforcement: “This is what happens to ICE when you do that.” The same actor claimed a hack of the department in March, when it posted the department's vendor-contract documents.
For the leak site, the release is about accountability. Its co-founder Emma Best said the search tool built for the data would “replace anonymity with accountability”, helping journalists, guiding public records requests and boosting congressional oversight. She called the leak “extraordinary but deceptive in its simplicity”, because it identifies the officials responsible for overseeing covert and undercover operations. Transparency advocates make a practical version of the same argument: names, email addresses and phone numbers are, in one researcher's words, “indispensable tools” for records requests that otherwise get stonewalled.
The department answered on Wednesday. “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” The FBI referred questions about the leak to the department, and the cybersecurity agency — itself among the components exposed — has made no public statement of its own that could be found. Beyond the promise to protect employees, no notification plan or protective measures had been set out in the reporting by Wednesday night.
Security experts who have seen the data describe a different kind of harm. “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” said Alexander Leslie, a national security expert at the threat-intelligence firm Recorded Future. Packaged with supervisors, duties and phone numbers, the names become far more useful to an adversary: enough to pick out vulnerable staff, build convincing impersonation attempts, or threaten investigations. It is the third major government data disclosure in a month, after September's theft of FBI personnel records and a Defense Department breach that exposed data on millions of military personnel.
For ordinary Americans, the stake runs in both directions. A department that holds enormous amounts of the public's own information — on travellers, immigrants, disaster victims and businesses — has had a fifth of its own workforce's details carried out the door, and its own inspector general has warned for years that access inside the department is not properly controlled. Data like this also arms the oldest trick in the book: a call or email that opens with a real name, a real title and a real office is far easier to believe, which is why officials urge checking any unexpected approach through a separate channel. And the other argument will be tested in public too — whether a searchable map of a powerful department's people produces the oversight its publishers promise, or simply paints targets on the men and women who staff the border, the investigations and the nation's cyber defences. The department says it will update the public when it has more. What it does next — for its own people first — is the measure of that promise.
📰 ProfiloPolitics Member News — choose your news, share it, earn credit
Members choose the news they want — share it and earn credit.
📣 Join ProfiloPolitics on Telegram — breaking news first
Follow @profilopoliticsnews for every update on this story.