DHS Data Leak Exposes Agency's Chain of Command

A searchable database listing names and contact information for more than 40,000 Department of Homeland Security employees was published Wednesday by the nonprofit leak collective Distributed Denial of Secrets. The group said the information could help identify agents involved in undercover work, special operations and surveillance. “This dataset is massive in terms of both size and impact,” said hacker and activist “maia arson crimew.” The database, they said, shows who does what across multiple DHS agencies, including ICE.

The release puts the department’s internal structure in public view: names, phone numbers, email addresses, job titles and email groups, including personnel at the Cybersecurity and Infrastructure Security Agency and Homeland Security Investigations. Some listed employees work in the intelligence community. NBC News reported the database covered nearly a third of ICE’s workforce, including some agents marked undercover, and roughly 15% of more than 260,000 people directly employed by the department.

Inside the DHS apparatus

Distributed Denial of Secrets said the searchable tool makes it easier to identify agents and their lines of command, and called the material “FOIA material for years to come.” The group said its targets included officials responsible for covert and undercover operations, the government’s hunt for leakers, the BlueLeaks investigation, and personnel involved in rendition and deportation programs.

DDoSecrets co-founder Emma Best said the leak was “replacing the regime’s anonymity with accountability.” Best said it could catalyze investigations, journalism, congressional inquiries, legal challenges, community action and Freedom of Information Act requests. Those are possible next steps named by the group, not outcomes already delivered.

The group did not identify the source of the personnel information, referring to the unnamed person as “the Department of Peace.” In March, that department leaked 6,000 DHS and Immigration and Customs Enforcement contracts with private universities and businesses, including Palantir, Microsoft, Oracle and Anduril. At the time, it said: “Why hack the DHS? I can think of a couple Pretti Good reasons! I'm releasing this because the DHS is killing us and people deserve to know which companies support them and what they're working on.”

The Hill reported that the hacks followed expanded immigration enforcement operations nationwide. The Deportation Data Project said ICE arrested 49,571 people in July 2026, its highest monthly arrest total during President Trump's second term. DHS hadn’t immediately responded to The Hill’s request for comment.

A federal ban with a thin explanation

DHS has also ordered civilian agencies to exclude Swiss cybersecurity firm Acronis AG from their networks and remove its products from agency information systems within 180 calendar days. The order, signed by Homeland Security Secretary Markwayne Mullin and dated July 31, was scheduled for publication in the Federal Register on Oct. 30. It bars Acronis, affiliated entities and products they directly or indirectly supply from ongoing and future procurement actions.

The department’s “summary of risks” says Acronis’s cyber and backup tools “have privileged or root access to customer security systems and present significant risk to the U.S. government information systems.” The document gives no further explanation. The director of national intelligence had barred Acronis from intelligence community procurements and systems the previous year, and the General Services Administration had removed its products and services from multiple-award schedules.

Acronis said the DHS order was expected as part of an earlier Federal Acquisition Supply Chain Security Act order and applies only to U.S. federal agencies. The company said it continues to work with government agencies to address concerns. Acronis hadn’t received a federal contract since fiscal 2016, according to USASpending.gov, but its products and services are sold through resellers and partners, making agency use difficult to track.

Compliance costs and the defense market

A separate Federal News Network commentary by Scott Montgomery, vice president of federal at Island, argued that the Pentagon can reform the Cybersecurity Maturity Model Certification without lowering cybersecurity standards. Montgomery said compliance costs and complexity can weigh especially heavily on smaller and non-traditional contractors, while companies may spend more time proving compliance than improving security. He warned that high entry costs risk excluding startups and commercial technology companies from defense work.

Montgomery proposed clearer requirements at contract formation, outcome-focused rules that let contractors choose technologies, and recognition of modern browser-based architecture where it provides equivalent protection to costly virtual desktop infrastructure. He also recommended continuous, risk-based reassessments instead of a three-year assessment cycle, clearer guidance for commercial cloud environments, and an authoritative interpretation register for NIST Special Publication 800-171.

The commentary cited a Russian drone attack on a gas station in Zaporizhzhia on July 6 and Ukraine’s Ministry of Defence reporting in September that successful strikes using AI guidance had increased tenfold since the beginning of the year. Montgomery’s closing argument was: “The answer is not less security. It is smarter security: measured by outcomes, adaptable to new technology, and fast enough to keep pace with a battlefield that can change in weeks, not years.”