After the cyberattack on Germany's far-right AfD party, America's deportation machinery is now taking a hit. More than 41,000 employees and contractors of the U.S. Department of Homeland Security have been caught up in a massive data leak. That's what happens when you do bad things. Among them are thousands of ICE agents, members of undercover investigative units, and Border Patrol personnel. The leaked documents reveal far more than personnel information. They offer a look inside secret surveillance programs and the inner workings of a security apparatus whose agents frequently hide their faces behind masks during arrests. While the AfD is dealing with the fallout from its own leak of internal information, a U.S. government department has lost control over part of its own digital administration. For a political movement that has made state-enforced toughness one of its defining promises, these are uncomfortable days.
They cover their faces, hide their names, and grab people off the streets. Anyone confronted by them is expected to show identification, obey orders, and disclose personal information. The agents themselves often remain unidentified. Now, of all agencies, the U.S. Department of Homeland Security has been hit by a massive data theft. More than 41,000 employees and contractors appear in the published records. Their names, work contact information, and job responsibilities are exposed. But what lies behind those personnel records is far more serious: undercover operations targeting political protest groups and communications surveillance programs. An administration that allows people to be scrutinized down to the most private details of their lives couldn't adequately protect its own employee directories.
This map shows the distribution of Department of Homeland Security employees included in the "Icepick" archive. Particularly striking is the concentration in the greater Washington, D.C., area, with 1,098 people. Other major concentrations appear along the West Coast and the Mexican border. The red circles indicate locations with particularly large numbers of registered employees. Thousands of additional records from smaller towns and overseas territories are not shown on the map.
On October 28, 2026, the dataset was posted online under the name "Icepick." According to those involved, the records came from the U.S. Department of Homeland Security, or DHS, and were last updated on August 19. The group behind the breach calls itself the Department of Peace. More than 21,000 of the people listed work for U.S. Customs and Border Protection, or CBP. Around 10,000 records involve Immigration and Customs Enforcement, or ICE, including its investigative division, Homeland Security Investigations. Another 6,200 belong to U.S. Citizenship and Immigration Services, or USCIS. Nearly 1,000 involve the Cybersecurity and Infrastructure Security Agency, or CISA. Altogether, the collection spans seven component agencies and covers approximately one-seventh of the Department of Homeland Security's workforce.
Here you can access the database, which we're also making available so that families still searching for missing or detained relatives may be able to find the appropriate contacts or facilities:
Particularly revealing is the connection between federal agencies and local police. Dozens of records carry job titles such as "Designated Immigration Officer" or "287(g) Officer." These refer to local law enforcement officers authorized under specific agreements to carry out certain immigration enforcement duties. Their listed workplaces include county sheriff's offices and jails. Trump's deportation policies therefore reach far beyond the federal immigration agencies themselves. Even police officers whose original responsibilities lie in local law enforcement are being drawn into the federal government's deportation policies. For those affected, the lines between ordinary policing and the enforcement of immigration policy are becoming increasingly difficult to distinguish.
Read also our article: Investigations reveal: Bounty list - How ICE pays local police for arrests, even involving children
The records also include around 4,400 people working in various support roles. Among them are software developers and data scientists, as well as nurses and employees at immigration detention facilities. Another 145 are specifically identified as contractors or high-risk contractors. More than 300 entries involve senior positions at DHS headquarters, from former Homeland Security Secretary Kristi Noem to senior officials responsible for intelligence matters and privacy. Most records also identify the employees' supervisors. This makes it possible to trace the department's administrative structure across numerous levels of authority. What looks like ordinary personnel administration reveals, on closer examination, how government decision-making power is distributed.
Even more explosive are more than 55,000 internal access groups. They determine which employees are allowed to access particular computer systems. Within Homeland Security Investigations, 39 employees from more than 12 field offices belong to groups whose names point to officially authorized undercover investigations. Another group references an operation called "Keyhole." U.S. court records connect that operation to covert surveillance of protest groups in Minneapolis. Other group names refer to communications wiretapping programs. The records offer a rare glimpse into the hidden workings of a government surveillance apparatus. Its power reaches into private conversations, while those being monitored often don't even know they're under surveillance. For a government capable of constantly scrutinizing its citizens, keeping its own activities hidden becomes an extraordinary privilege.
The map shows the geographic distribution of Department of Homeland Security employees whose information was made public through the hack. Each red circle represents a location, and its size indicates the number of people listed there. Particularly high concentrations appear along the East Coast, in California, and along the Mexican border. Thousands of other affected individuals are not shown on the map, including 3,349 people from 531 smaller locations. The data from the published "Icepick" archive illustrates just how far America's immigration and security apparatus extends across the country.
Minneapolis carries particularly disturbing significance in this context. ICE agents shot and killed Alex Pretti and Renee Good there this year. According to the available reports, neither was the intended target of the respective arrests. At the same time, extensive investigations took place in Minnesota targeting people who opposed the deportation policies. In June, 15 residents were charged over alleged stalking and threats of violence. Prosecutors linked the allegations to activities opposing ICE. Another operation involved more than 100 Homeland Security Investigations agents, including undercover operatives. The measures included extensive surveillance and infiltration of private group chats. The government was also watching the very people protesting its actions.
The technology used for this reaches deep into private communications. Internal access groups reference Falcon, an investigative platform developed by Palantir, and PenLink, which can analyze phone records and activity on social media. More than 700 user accounts belong to a group whose name references the encrypted messaging service Signal. More than 200 Border Patrol accounts belong to a group that appears to be connected to Mobile Fortify, a facial recognition application. The employees include members of tactical units and intelligence analysis teams. Roughly half of these accounts are located in Texas, California, and Arizona. Membership in these groups alone does not establish that every individual employee actually used each program. But it does reveal how many technological surveillance capabilities are managed within these agencies.
Even the department's highest leadership appears in the dataset. The two access groups "Executive Leadership" and "AI Access" contain the same 13 people. They appear to allow exceptions to internal internet restrictions. Those listed include former Secretary Kristi Noem and former chief information officer Antoine McCord, who has since returned to the defense technology company Anduril. Also included are Philip Hegseth, the younger brother of Defense Secretary Pete Hegseth, and Jayce Krachenfels, who previously worked on Donald Trump's 2024 presidential campaign. None of those named responded to requests for comment. Other groups reference ChatGPT and Google's Gemini. One group called "Grok.com" includes eight technology officials at the department, among them former senior personnel. The records do not reveal whether any government information was processed through these applications or, if so, what information.
The political implications of the data leak go much deeper. The Trump administration is prosecuting people for publishing information about individual ICE agents. Others have been approached by federal agents over similar social media posts and ordered to take them down. Meanwhile, the Department of Homeland Security is attempting to identify anonymous critics and obtain information about people participating in political protests. Surveillance operations targeting journalists have also been documented. An administration whose armed agents frequently operate with their faces concealed is demanding protection from public identification for its employees, increasingly extending that protection even to basic professional information. Citizens are expected to be transparent to the government. The government itself claims the right to hide its faces. In this relationship, the fear of being identified has become an extraordinarily one-sided affair.
American civil liberties attorney Adam Steinbaugh of the organization FIRE disputes this sweeping interpretation. The administration relies in part on federal law 18 USC 119, which prohibits publishing restricted personal information about federal officers or their families when done with the intent to threaten them. Names and basic professional information of the kind found on an ordinary business card, however, cannot simply be criminalized across the board. The distinction between protection against personal threats and the public accountability of government employees is crucial. An officer receives authority through the law. That also means the officer's actions must remain subject to legal scrutiny. A mask must never erase that responsibility.
But the publication is necessary because of the lack of accountability within the Department of Homeland Security. Many employees themselves are aware of how unpopular their agency is and conceal what they actually do. Some professional profiles online reportedly say little more than that the person does "stuff at the U.S. government." If employees weren't hiding their involvement in the government's repressive apparatus, nobody would need to expose them. The publication of the dataset is therefore explicitly intended as a means of public oversight. The authorities have information about the public, which is why their own information has now been exposed as well. Extraordinary times sometimes call for extraordinary measures.
The Department of Homeland Security confirmed that it is investigating a possible security incident and working to address it. Threats against employees would be taken seriously. The hackers claim they gained access to the information through Okta, a centralized login service. Okta, however, said there was no evidence that its own systems had been breached. Exactly how the attackers gained access remains unclear. Back in September, the group ShinyHunters claimed to have stolen personal information about nearly all FBI employees and their families. Several suspects were arrested. Just recently, the Federal Election Commission was also temporarily taken offline following a suspected hacking attempt.
Security expert Alexander Leslie of Recorded Future warned about the consequences. If the information is authentic and current, it could be of extraordinary intelligence value to attackers. Combined with previously stolen information, it could allow them to deceive employees through targeted impersonation attempts and jeopardize ongoing investigations. The danger also affects people whose work has absolutely nothing to do with the controversial deportation operations. The uncontrolled publication of such information creates risks of its own. It replaces neither a judicial investigation nor the legal accountability of individual officers. Yet the very department that demands ever deeper access to other people's lives was unable to adequately protect its own information. Government power apparently has a vulnerable spot once those exercising oversight become the subjects of scrutiny themselves.
Since Trump's return to the White House, nearly 1 million people have been deported, according to the Migration Policy Institute. More than 70 percent had no criminal records, while around 20 percent had committed minor offenses. This year alone, ICE agents have shot at more than 24 people during operations. At least nine died. Behind those numbers are people whose lives were ended by government violence, and families demanding answers. Meanwhile, agents frequently operate without visible identification, even though the law requires them to identify themselves. Members of Congress have already called on the Department of Homeland Security to enforce that requirement.
The exposure of 41,000 personnel records now reveals just how far Trump's deportation apparatus extends organizationally and what technological capabilities its agencies control. It also exposes the appalling inability of an administration to protect its own information. The personal safety of employees who have done nothing wrong must not be sacrificed, any more than the public's right to scrutinize government violence. Between those two obligations lies a boundary that determines the value of the rule of law. Yet while Washington aggressively prosecutes the publication of professional information about ICE agents, the faces of numerous armed officers remain concealed. The hack has exposed these contradictions deep within the administrative structures of the Department of Homeland Security. For the families of Alex Pretti and Renee Good, the central question remains exactly where it stood before the data leak: with the people who carried government-issued weapons and those who gave them that power. America already knows the names of their loved ones who were killed. The responsibility for their deaths still demands answers.
To be continued ...
Updates – Kaizen News Brief
Alle aktuellen ausgesuchten Tagesmeldungen findet ihr in den Kaizen Kurznachrichten.
To the Kaizen News Brief In English
Diese Recherche und Veröffentlichung hat es in sich.
Die Regierung fordert für sich die absolute Anonymität und will gleichzeitig den kontrollierbaren gläsernen Bürger.
Es ist wichtig und richtig, dass das ans Licht kommt.
Der Verweis auf Ermittlungen, die nichts mit der Abschiedemaschinerie zu tun haben, ist richtig.
Aber in der Gesamtbetrachtung sicher nur ein winziger Teil.
Und wäre die Regierung transparent, wären solch Hackerangriffe nicht notwendig.
Es ist gut, dass man diese Datenbank einsehen kann.
Ich bin mir sicher, dass Jeder dankbar ist zu wissen, ob neben ihm ein ICE Handlanger wohnt.
Und ob man selber im Visier des DOJ ist.
Klingt vielleicht naiv, aber genau so etwas habe ich mir gewünscht.
Da muss auf der Ebene noch viel mehr passieren, bevor mit Palantir und Co eine totale irreversible Kontrolle eingerichtet ist.
… es ist die Geschichte vom Krug und Brunnen
Man ist geneigt, das positiv zu sehen, solange es gute Kräfte sind, die die Datenbanken der Bösen hacken. Aber Tech-Know How kennt kein Gut oder Böse, es liebt wohl vor allem die sportliche Herausforderung. Moralisch ist das ein zweischneidiges Schwert. Denn wenn man den gläsernen Menschen nicht will, ist Hacken auch dann nichts per se Wünschenswertes, wenn es dem Guten dient.
Allerdings darf man es auch nicht der Gegenseite überlassen. Das alte Dilemma: Darf man sich selbst auch dann mit allen Mitteln verteidigen, wenn man Pazifist ist? Ein Problem, vor dem abgewandelt Demokratien derzeit stehen, wenn antidemokratische Kräfte sich für ihr Emporkommen demokratischer Strukturen bedienen. Man kann nur hoffen, dass all das am Ende zu etwas Gutem führt. Brasilien hat es trotz massiver Intervention geschafft, sich neu aufzustellen. Ungarn und Serbien haben eine Wende herbeigeführt. Jetzt müssen die Amis beweisen, dass sie doch noch wissen, was Recht und was Unrecht ist, und dass sie erkennen: Nicht immer ist der, der am lautesten brüllt, auch kompetent. Auch der deutsche Verfassungsschutz muss endlich Nägeln mit Köpfen machen und ein Verbotsverfahren der Nazi-Sekte einleiten, das längst überfällig ist.
Es sieht vielversprechend für die Midterms aus. Leider ist wohl nicht davon auszugehen, dass die Republikaner einen für sie negativen Wahlausgang einfach so akzeptieren werden. Siehe Alaska schon jetzt. Die Wahlbetrugsmasche wird auf die Spitze getrieben werden. Es wird sich danach also vermutlich noch nicht so viel ändern, mit Chance sogar erst einmal noch schlimmer werden. Narzissten ertragen keine Niederlage, sie werden wütend und unkontrollierbar. Aber möglicherweise wird es dennoch schwieriger, diese korrupte, gewalttätige, wirtschaftlich wie politisch desaströs inkompetente Narzissten-Politik durchzubringen. Die Hoffnung stirbt zuletzt. Bislang ist nicht erkennbar, dass Trump endlich das Handwerk gelegt werden könnte, weder politisch, noch juristisch. Einfach weil es zu viele reiche Profiteure gibt.
…wie bereits oben auf alle Themen des Kommentars bezogen, es ist die Geschichte von Brunnen und Krug