Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates.

一份史无前例的国土安全部记录泄露事件，曝光了超过 41,000 名在该部门及其下属机构工作的员工或承包商的详细信息。这些记录不仅包含电子邮件地址、电话号码和办公地址，还涉及内部系统以及有关卧底和监视项目的敏感信息。总而言之，此次泄露为外界提供了一份国土安全部组织架构及其运作方式的蓝图。

The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, which they say they obtained from a group calling itself the Department of Peace.

这些记录涵盖了国土安全部本身以及包括移民及海关执法局（ICE）和美国海关及边境保卫局（CBP）在内的七个组成机构，最后更新日期为 2026 年 8 月 19 日。透明度非营利组织“分布式拒绝秘密”（Distributed Denial of Secrets）以及网络安全研究员兼记者 maia arson crimew 向《连线》（WIRED）杂志提供了这些数据，他们称这些数据是从一个自称为“和平部”（Department of Peace）的组织处获得的。

DDoSecrets published the archive, which it calls “Icepick,” on Wednesday. In a press release, DDoSecrets says the data is from DHS’s Okta login system. In a note with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs.”

DDoSecrets 于周三发布了该档案，并将其命名为“冰镐”（Icepick）。在新闻稿中，DDoSecrets 表示这些数据来自国土安全部的 Okta 登录系统。黑客在随文件附带的说明中写道：“他们掌握了我们的信息，所以我们掌握他们的信息也是公平的。”

An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says.

Okta 的一位发言人告诉《连线》，公司并未察觉其系统遭到任何入侵。“我们已知悉此报告。Okta 是安全的，我们没有证据表明我们的数据或系统受到损害，”该发言人表示。

The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees’ names and faces. The agency has also expanded its definition of “doxing”—a term that typically refers to publishing someone’s home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles.

此次泄露发生之际，国土安全部正积极追查其批评者，试图揭露匿名社交媒体用户的身份，获取抗议者的客户记录，并为针对记者的监视工具申请搜查令。自第二届特朗普政府上台以来，国土安全部和联邦政府已采取行动，隐匿国土安全部员工的姓名和面孔。该机构还扩大了“人肉搜索”（doxing）的定义——该术语通常指为恶意目的发布某人的家庭住址和其他个人详细信息——将其范围扩大到发布公职人员的基本事实，例如他们的姓名和头衔。

The leak follows a breach in which a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group.

在此次泄露之前，曾发生过一起黑客攻击事件，一个名为 ShinyHunters 的黑客组织声称窃取了几乎所有联邦调查局（FBI）员工及其家人的个人信息。执法机构已逮捕了几名嫌疑人，并拘留了另一名据称是该组织成员的人。

The DHS records are searchable on a website crimew built. “I don’t think we should let them scare us into not looking into them,” she tells WIRED.

这些国土安全部的记录可以在 crimew 建立的一个网站上进行搜索。“我认为我们不应该让他们通过恐吓来阻止我们调查他们，”她告诉《连线》。

The DHS and DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS.

国土安全部和司法部没有回应《连线》的置评请求。联邦调查局将《连线》的询问转交给了国土安全部。

According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.

根据《连线》对数据的分析，海关及边境保卫局（CBP）的工作人员占记录总数的一半以上。移民及海关执法局（ICE）约占 10,000 条，其中约三分之一属于 ICE 的调查部门——国土安全调查处（HSI）。另有 6,200 条属于美国公民及移民服务局，近 1,000 条与网络安全和基础设施安全局（CISA）有关，其中超过一半是承包商。总而言之，这些文件涵盖了国土安全部约七分之一的员工，揭示了国土安全部从高层领导到个人移民代理人和拘留承包商的组织结构。

Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.” Another group, apparently based in HSI’s St. Paul, Minnesota, area of operations, references “Keyhole,” which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”

根据泄露的记录，像大多数大型组织一样，国土安全部使用权限组来控制对内部系统的访问。泄露名单中几乎每个人都能访问其中至少部分系统。在国土安全调查处（HSI），分布在十几个外勤办公室的 39 名员工属于名称中包含“CUC”的组，政府法庭文件显示，这代表“认证卧底行动”（certified undercover operation）。另一个显然位于 HSI 明尼苏达州圣保罗行动区的组提到了“锁孔”（Keyhole），联邦法庭文件将其描述为一项认证卧底行动，该行动最近资助了 HSI 今年早些时候对明尼阿波利斯抗议团体的卧底监视。其他组则提到了“通信拦截中心技术运营（CICTO）项目”、“用于窃听的第三章拦截项目”（Title III Intercept Program）以及“非法传感器拦截项目”（ISIP）。

The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.

这些组的名称（总数超过 55,000 个）似乎指向了用于访问移民法庭记录、从被扣押手机中提取数据以及进行监视的工具。其中包括 Palantir 的 Falcon 调查平台和用于分析电话记录及社交媒体的 PenLink。

Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS’s web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of defense secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile. Noem, McCord, Hegseth, and Krachenfels did not respond to a request for comment.

两个名为“行政领导层”（Executive Leadership）和“人工智能访问”（AI Access）的权限组，似乎列出了被允许绕过国土安全部网络过滤器（该过滤器会阻止员工访问某些网站）的人员。这两个组包含相同的 13 人，其中包括前国土安全部负责人克里斯蒂·诺姆（Kristi Noem）；最近离职并已回到国防科技公司 Anduril 的国土安全部首席信息官安托万·麦科德（Antoine McCord）；被列为国土安全部部长高级顾问、国防部长皮特·海格塞斯（Pete Hegseth）的弟弟菲利普·海格塞斯（Philip Hegseth）；以及根据其领英资料显示，曾担任唐纳德·特朗普 2024 年总统竞选活动区域现场主任、现被列为政策顾问的杰斯·克拉肯费尔斯（Jayce Krachenfels）。诺姆、麦科德、海格塞斯和克拉肯费尔斯均未回应置评请求。

Other groups named in the leak reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One, called “Grok.com,” includes eight DHS technology officials, including the department’s former chief information officer and chief data officer.

泄露名单中提到的其他组涉及人工智能工具，包括 OpenAI 的 ChatGPT、谷歌的 Gemini 和微软的 Copilot。其中一个名为“Grok.com”的组包括八名国土安全部技术官员，其中包括该部门的前首席信息官和首席数据官。

“If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” says Alexander Leslie, a national security expert at the threat intelligence company Recorded Future. “This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.”

“如果这些数据是真实且最新的，那么对于那些试图渗透国土安全部的人来说，这是一个极其有价值的情报资源，”威胁情报公司 Recorded Future 的国家安全专家亚历山大·莱斯利（Alexander Leslie）表示。“当这个数据集与之前泄露的信息、商业数据和其他情报收集结果相关联时，其价值会大幅提升。对手可以花费数月时间利用这些关系来识别易受攻击的人员、制定令人信服的冒充企图，或破坏正在进行的调查。”

More than 700 accounts are associated with a group apparently referencing Signal, the encrypted messaging app, nearly all belonging to CBP personnel. More than 200 CBP accounts belong.

超过 700 个账户与一个显然指向加密消息应用程序 Signal 的组相关联，几乎所有账户都属于海关及边境保卫局（CBP）的人员。超过 200 个 CBP 账户属于……