Massive leak exposes 41,000 DHS workers and undercover ICE agents

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates.

一份史无前例的国土安全部（DHS）记录泄露事件，曝光了超过 41,000 名为该部门及其下属机构工作的员工或承包商的详细信息。这些记录不仅包含电子邮件地址、电话号码和办公地址，还涉及内部系统以及有关卧底和监视计划的敏感信息。总而言之，此次泄露为外界提供了一份了解国土安全部组织架构及其运作方式的地图。

The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data for WIRED, which they say they obtained from a group calling itself the Department of Peace. DDoSecrets published the archive, which it calls “Icepick,” on Wednesday.

这些记录涵盖了国土安全部本身以及包括移民和海关执法局（ICE）和美国海关及边境保卫局（CBP）在内的七个组成机构，最后更新日期为 2026 年 8 月 19 日。透明度非营利组织“分布式拒绝秘密”（Distributed Denial of Secrets）以及网络安全研究员兼记者 maia arson crimew 为《连线》（WIRED）杂志预览了这些数据，他们称这些数据是从一个自称为“和平部”（Department of Peace）的组织处获得的。DDoSecrets 于周三发布了该档案，并将其命名为“冰镐”（Icepick）。

In a press release, DDoSecrets says the data is from DHS’s Okta login system. In a note with the files, the hackers wrote, “They have our information, so it’s only fair that we have theirs.” An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised,” the spokesperson says.

在一份新闻稿中，DDoSecrets 表示这些数据来自国土安全部的 Okta 登录系统。黑客在随附的说明中写道：“他们掌握了我们的信息，所以我们掌握他们的信息也是公平的。”Okta 的一位发言人告诉《连线》，公司并未察觉其系统遭到任何入侵。“我们已知悉此报告。Okta 是安全的，我们没有证据表明我们的数据或系统受到损害，”该发言人表示。

The leak comes as DHS has aggressively pursued its critics, seeking to unmask anonymous social media users, obtain customer records on protesters, and secure warrants for surveillance tools aimed at reporters. Since the start of the second Trump administration, DHS and the federal government have moved to hide DHS employees’ names and faces. The agency has also expanded its definition of “doxing”—a term that typically refers to publishing someone’s home address and other personal details for malicious purposes—to encompass the publication of basic facts about public employees, like their names and titles.

此次泄露发生之际，国土安全部正积极追查其批评者，试图揭露匿名社交媒体用户的身份，获取抗议者的客户记录，并为针对记者的监视工具申请搜查令。自第二届特朗普政府上台以来，国土安全部和联邦政府已采取行动隐藏国土安全部员工的姓名和面孔。该机构还扩大了“人肉搜索”（doxing）的定义——这一术语通常指为恶意目的发布某人的家庭住址和其他个人详细信息——将其涵盖范围扩大到发布公职人员的基本事实，例如他们的姓名和头衔。

The leak follows a breach in which a group of hackers known as ShinyHunters claimed to have stolen personal information on nearly every FBI employee and their families. Law enforcement agencies have arrested several suspects and detained another who is alleged to be part of the group. The DHS records are searchable on a website crimew built. “I don’t think we should let them scare us into not looking into them,” she tells WIRED.

在此次泄露之前，曾发生过一起黑客组织 ShinyHunters 声称窃取了几乎所有联邦调查局（FBI）员工及其家属个人信息的入侵事件。执法机构已逮捕了几名嫌疑人，并拘留了另一名据称是该组织成员的人。这些国土安全部的记录可以在 crimew 建立的一个网站上进行搜索。“我不认为我们应该让他们吓倒，从而不去调查他们，”她告诉《连线》。

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a Homeland Security spokesperson tells WIRED. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.” The DOJ did not respond to WIRED’s request for comment. The FBI referred WIRED’s inquiry to DHS.

“国土安全部已知悉潜在的泄露事件，并正在积极努力迅速有效地处理这一情况，”国土安全部的一位发言人告诉《连线》。“我们认真对待所有针对我们员工和官员的安全威胁，并将努力确保所有人得到妥善保护。当有更多信息时，我们将向公众通报。”司法部未回应《连线》的置评请求。联邦调查局将《连线》的询问转交给了国土安全部。

According to a WIRED analysis of the data, CBP staffers account for more than half of the records. ICE accounts for about 10,000, roughly a third of them in Homeland Security Investigations, ICE’s investigative wing. Another 6,200 belong to US Citizenship and Immigration Services, and nearly 1,000 are tied to the Cybersecurity and Infrastructure Security Agency, more than half of them contractors. Altogether, the files cover about a seventh of DHS’s workforce, revealing how DHS is structured, from senior leadership down to individual immigration agents and detention contractors.

根据《连线》对数据的分析，海关及边境保卫局（CBP）的工作人员占了记录的一半以上。移民和海关执法局（ICE）约占 10,000 条，其中约三分之一属于 ICE 的调查部门——国土安全调查处（HSI）。另有 6,200 条属于美国公民及移民服务局，近 1,000 条与网络安全和基础设施安全局（CISA）有关，其中超过一半是承包商。总的来说，这些文件覆盖了国土安全部约七分之一的员工，揭示了国土安全部从高级领导层到个人移民代理和拘留承包商的组织结构。

Like most large organizations, DHS uses permission groups to control access to internal systems, according to the leaked records. Nearly everyone named in the leak has access to at least some of these systems. At HSI, 39 employees across more than a dozen field offices belong to groups whose names include “CUC,” which government court filings say stands for “certified undercover operation.”

根据泄露的记录，像大多数大型组织一样，国土安全部使用权限组来控制对内部系统的访问。泄露名单中几乎每个人都至少有权访问其中一些系统。在国土安全调查处（HSI），分布在十几个外勤办公室的 39 名员工属于名称中包含“CUC”的组，政府法庭文件称这代表“认证卧底行动”（certified undercover operation）。

Another group, apparently based in HSI’s St. Paul, Minnesota, area of operations, references “Keyhole,” which federal court filings describe as a certified undercover operation that recently funded HSI’s undercover surveillance of Minneapolis protest groups earlier this year. Others reference a “Communications Intercept Center TechOps (CICTO) Program,” a “Title III Intercept Program” for wiretaps, and an “Illicit Sensor Intercept Program (ISIP).”

另一个显然位于明尼苏达州圣保罗市 HSI 运营区的组提到了“锁孔”（Keyhole），联邦法庭文件将其描述为一项认证卧底行动，该行动最近资助了 HSI 今年早些时候对明尼阿波利斯抗议团体的卧底监视。其他组则提到了“通信拦截中心技术运营（CICTO）计划”、用于窃听的“第三章拦截计划”以及“非法传感器拦截计划（ISIP）”。

The names of the groups—there are over 55,000 in all—appear to reference tools for accessing immigration court records, pulling data from seized phones, and conducting surveillance. These include Palantir’s Falcon investigative platform and PenLink, which analyzes phone records and social media.

这些组的名称（总共有超过 55,000 个）似乎指向了用于访问移民法庭记录、从被扣押手机中提取数据以及进行监视的工具。其中包括 Palantir 的 Falcon 调查平台和用于分析电话记录及社交媒体的 PenLink。

Two permission groups, named “Executive Leadership” and “AI Access,” appear to list people given exceptions to DHS’s web filter, which blocks some websites for employees. They contain the same 13 people, including former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of Defense Secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile. Noem, McCord, Hegseth, and Krachenfels did not respond to a request for comment.

两个名为“行政领导层”和“人工智能访问”的权限组，似乎列出了被允许绕过国土安全部网络过滤器（该过滤器会阻止员工访问某些网站）的人员。这两个组包含相同的 13 人，其中包括前国土安全部部长克里斯蒂·诺姆（Kristi Noem）；最近离职并已回到国防科技公司 Anduril 的国土安全部首席信息官安托万·麦科德（Antoine McCord）；被列为国土安全部部长高级顾问、国防部长皮特·海格塞斯（Pete Hegseth）的弟弟菲利普·海格塞斯（Philip Hegseth）；以及被列为政策顾问的杰斯·克拉琴费尔斯（Jayce Krachenfels），根据其领英资料，他曾担任唐纳德·特朗普 2024 年总统竞选活动的区域现场主任。诺姆、麦科德、海格塞斯和克拉琴费尔斯均未回应置评请求。

Other groups named in the leak reference AI tools, including OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One, called “Grok.com,” includes eight DHS technology officials, including the department’s former chief information officer and chief data officer. “If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS,” says Alexander Leslie, a national security expert at the threat intelligence company Recorded Future. “This dataset becomes way more valuable when corr

泄露名单中提到的其他组涉及人工智能工具，包括 OpenAI 的 ChatGPT、谷歌的 Gemini 和微软的 Copilot。其中一个名为“Grok.com”的组包括八名国土安全部技术官员，其中包括该部门的前首席信息官和首席数据官。“如果这些数据是真实且最新的，那么对于那些试图渗透国土安全部的人来说，这是一个非常有价值的情报资源，”威胁情报公司 Recorded Future 的国家安全专家亚历山大·莱斯利（Alexander Leslie）表示。“当这些数据集与……”