Distributed Denial of Secrets (DDoSecrets) published records identifying more than 41,000 U.S. Department of Homeland Security employees and contractors, including personnel across agencies such as ICE. The archive included names, work emails, mobile numbers, offices and assignments; the data did not appear to include home addresses or personal email addresses.

DDoSecrets said the release was intended to promote transparency about personnel involved in President Trump’s deportation campaign. A searchable tool created by Swiss cybersecurity researcher and journalist maia arson crimew was presented as a way to examine DHS’s organization and support reporting, public-records requests and congressional oversight.

The group said the records came from an entity calling itself the Department of Peace, which framed the disclosure as a response to government surveillance and immigration enforcement. Best said the information was obtained through DHS’s Okta sign-on service, but Reuters could not corroborate that account; Okta said it had no evidence its systems or data were compromised.

The records’ timestamps suggest the data may have been taken around mid-August. TechCrunch verified a portion of the material, while Reuters matched information on about six named employees against other records and confirmed details directly with three; the full dataset could not be independently verified.

Beyond personnel details, the files appear to expose information about operations, reporting relationships and connected applications. They reference undercover work, wiretapping and surveillance, as well as tools including Palantir’s Falcon, PenLink, Cellebrite and Mobile Fortify, alongside AI services such as ChatGPT, Gemini, Copilot and Grok.

Among the records were more than 200 CBP accounts in a group referencing Mobile Fortify, a facial-recognition app used by immigration agents, and nearly all of more than 700 accounts in a Signal-related group belonged to CBP staff. The archive also included local law-enforcement personnel authorized to perform immigration duties, military support personnel, National Guard members and contractors.

The disclosure could create serious risks: Alexander Leslie warned that combining the records with other compromised or commercial data could enable targeted impersonation, exploitation of personnel or interference with investigations. Employees also expressed concern about being identified and linked to the administration’s immigration crackdown, while records appeared to include people connected to undercover operations.

CNN’s preliminary review found some information was accurate, including phone numbers, supervisors and assignments, and data on at least three ICE and Border Patrol officers involved in shootings during the second Trump administration. Fox News also verified names of several undercover ICE agents in different parts of the country.

The searchable database was briefly taken offline after its registrar placed the domain on “serverHold.” Homeland Security had submitted a takedown request through ZeroFox, a security vendor authorized to act on the department’s behalf, citing individuals’ contact and location data; the archive was later republished at another domain.

Bluesky blocked links to the records, saying they shared personal email addresses and phone numbers without authorization and violated its guidelines. The company said blocking links, rather than removing posts, preserved wider discussion and access to reporting, but did not say whether the action was automatic or prompted by a government agency; the archive remained accessible through at least one third-party Bluesky app.

The incident lands amid backlash over immigration enforcement and a series of government cyber incidents, including recent claims involving FBI employee data and a separate breach affecting millions of military personnel. Former DHS official Thomas Warrick urged Congress to investigate and called for stronger security practices, while Sarah Pierce of Third Way said ordinary civil servants should not be targeted for policies they did not design.

DHS said it was aware of a potential breach, was working to address it and would seek to protect affected employees and officers. Okta said it had no evidence its systems or data were compromised; the hacker did not answer questions about how the breach occurred.