OMITTED

What the news leaves out.

← Omitted front page

Hacker Leaks Data of Over 40000 Homeland Security Employees

12 sources · updated 2026-10-30
Left 50% Center 25% Right 25%
6 left · 3 center · 3 right

What happened

The story was first reported by TechCrunch on October 28, 2026, citing a hacker who goes by the handle Department of Peace; The Verge credited that report as the origin, and Distributed Denial of Secrets was the first on-record source (The Hill, October 28, 2026). The hacker claimed to have taken more than 40,000 Department of Homeland Security employee and contractor records—including more than 21,000 at Customs and Border Protection and thousands at Immigration and Customs Enforcement—from an Okta single sign-on system used by the department, capturing names, job titles, work emails, phone numbers, office locations, and Active Directory group memberships, among them groups tied to surveillance tools such as Mobile Fortify and PenLink, and said DHS staff “have our information, so it’s only fair that we have theirs.” Researcher maia arson crimew received the files and Distributed Denial of Secrets published them as a searchable dataset named Icepick that also listed previously undisclosed operation names and assignments, including undercover and special-operations work. DHS said it was “aware of a potential breach and is actively working to address the situation swiftly and effectively” and would “work to ensure all are properly protected”; Okta said it was “secure” and had “no evidence our data or systems were compromised.” TechCrunch and Reuters authenticated portions of the records against known employees, and Fox News independently confirmed that the leak included names of several undercover ICE agents.
Sourcing check · Mostly on the record · 12 articles

9 of 12 articles cite a named source for the story. It started with unnamed sources; a named source appeared 2 hours later.

What these terms mean and how they're counted
On the record · names a source 9 of 12
On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Distributed Denial of Secrets, Emma Best, DHS, ZeroFox, DHS spokesperson and Department of Homeland Security
Primary evidence · cites a document or data 2 of 12
Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: database, leaked database, press statement
Credits another outlet 2 of 12
The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: TechCrunch
Unnamed sources 3 of 12
The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this. Here: e.g. “The hacker who goes by the handle Department of Peace”
How it developed
When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 28, 20:01 UTC by TechCrunch, with no named source. First named source 2 hours later, from The Hill. First document 5 hours later, from BBC (database).
Not counted 0
Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out

Unpacked

Right-leaning coverage is less complete on the contents of the dump: it never names the surveillance products that left-leaning coverage says the leaked records map to individual staff. Those products include facial-recognition and phone-analysis software, according to The Verge. Even the longer right-leaning write-up stops at job categories such as surveillance and undercover work, so readers there get a contact list and not an access map of who can run those tools. Left-leaning coverage opens on a hacker or a nonprofit releasing Homeland Security staff files. Fox News opens on the department investigating an exposure of ICE and Border Patrol agents. Who was posted comes first on one side, and who must be protected comes first on the other. How did the thief extract the Okta directory if the vendor says its systems were never compromised?
Bottom line

Read Fox and the Homeland Security hack is a giant lost phone book of ICE and Border Patrol. Read The Verge and the same file also shows which staff can run face scans and phone tracking.

The receipts — 5 facts one side's coverage lacks
  • The leaked records link employees to the facial-recognition app Mobile Fortify and to PenLink, which can collect and analyze data from phones contextin The Verge · absent from right-leaning coverage
  • The leak included tech provided by Cellbrite and Palantir contextin BBC · absent from right-leaning coverage
  • Fox News independently confirmed the leaked records include the names of several undercover ICE agents in different parts of the country individual casein Fox News · absent from left-leaning coverage
  • The Department of Peace said it published the data in response to Secretary Mullin saying ICE would be turning up the heat official statementin BBC, CNBC · absent from right-leaning coverage
  • ICE agents often work with faces covered by masks and sunglasses and rarely identify themselves contextin BBC · absent from right-leaning coverage
The Left View
Left-leaning outlets cast the publication as scrutiny of an agency that, they said, conceals CBP and ICE agents—including those who “have carried out anti-immigration raids” and appear masked—while it “has aggressively sought to unmask critics on social media, and obtain records on protestors and journalists” (Guardian). They foregrounded DDoSecrets co-founder Emma Best’s claim that a public search tool would “replace anonymity with accountability” and “empower journalists, guide public records requests and boost congressional oversight,” and quoted transparency advocates calling work emails and phones “indispensable tools for FOIA.” Coverage tied the hacker’s motive to Secretary Markwayne Mullin’s July 17 remark about ICE “turning up the heat,” and to a backlash against intensified arrests and deportations that BBC said have “repeatedly turned violent,” with agents “shooting at more than two dozen people and killing at least nine.” They also stressed that the files identify “the officials responsible for overseeing covert and undercover operations” and employee access to contractor surveillance products.
The Right View
Right-leaning outlets treated the episode as a personnel-security crisis rather than a transparency gain. Fox News, citing sources, called it a “catastrophic” security incident, underlined the confirmed naming of undercover ICE agents in different parts of the country, and nested the leak in a climate of “attacks on ICE officers” that it said have “skyrocket[ed],” alongside Mullin’s criticism of sanctuary politicians. They grouped the dump with recent FBI and Pentagon personnel breaches as a pattern of exposed U.S. government staff. The New York Post similarly led on DHS’s investigation and on details about officials in “sensitive fields such as surveillance and human intelligence,” not on the publishers’ accountability rationale.
Our Take (balanced)
The left’s strongest argument is that the files pierce official anonymity around immigration and surveillance work the agency will not voluntarily disclose: Best’s “replace anonymity with accountability” line is backed by authenticated nonpublic organization and operations data, and by FOIA practitioners who say named emails and phones are what make records requests succeed. The right’s strongest argument is officer safety: Fox News’s confirmation that undercover ICE agents were named, DHS’s language about “all security threats against our employees and officers,” and reporting that attacks on those officers are already rising. The central unresolved tension is whether this publication is a check on secretive enforcement or an exposure of law-enforcement personnel whose personal security is the harm, not the remedy.

12 sources

More stories

The week's bottom lines, in your inbox

One email a week: the five stories that mattered and what they actually mean. Free.