Hackers have published the names, job titles, work emails, phone numbers and office locations of more than 40,000 Department of Homeland Security employees and contractors, about a fifth of the department, including roughly 21,000 at Customs and Border Protection and 10,000 at ICE and Homeland Security Investigations. The ICE List is reading every record, and every ICE and CBP officer in it who takes part in enforcement will be added to the public record.

The data was released on Wednesday by Distributed Denial of Secrets, the non-profit leak archive, under the name Icepick, with a search tool built by the hacker and journalist maia arson crimew. A group calling itself the Department of Peace says it took the records from DHS's Okta single sign-on system; the timestamps point to mid-August, which means the department sat on a breach of its own staff directory for two months, if it knew. Its note reads: "They have our information, so it's only fair that we have theirs." Okta says it has "no evidence our data or systems were compromised". DHS, ICE and CBP did not answer Reuters, TechCrunch or Straight Arrow News.

The records are real. TechCrunch matched several known DHS employees against an offline copy. Reuters matched six named employees to credit bureau and breach records and telephoned three of them, who confirmed their numbers; one had not heard of a breach until the call. Beyond names, the Okta data lists the groups each user belongs to, and the group names describe the work: Undercover Operations, Covert Operations, Special Operations to Counter Intelligence, computer forensics, surveillance. Dozens of groups reference Penlink, a surveillance contractor, one of them with more than 2,000 HSI users, and more than 200 CBP users are tied to Mobile Fortify, the facial recognition app agents point at people in the street.