Names, job titles, office locations, and phone numbers for more than 41,000 U.S. Department of Homeland Security employees and contractors were published online Wednesday by a transparency nonprofit, which says the records were handed over by a politically motivated hacking group.

The nonprofit, Distributed Denial of Secrets, publishes leaked documents and has previously published large U.S. law-enforcement datasets, including police records in 2020. It released the DHS material under the name Icepick on Oct. 28, and says the hackers, who call themselves the Department of Peace, took the records from an Okta single sign-on service used by DHS — a login system that lets employees access many internal tools with one account, and one that typically stores a profile for every worker it manages. Hacktivists are hackers driven by politics rather than profit.

Okta, the company behind the login service, disputed the claim. “Okta is secure, and we have no evidence our data or systems were compromised,” the company told Reuters. The San Francisco-based firm’s sign-in software underpins employee logins at thousands of organizations worldwide.

The Department of Peace says it acted after Homeland Security Secretary Markwayne Mullin pledged stepped-up operations by Immigration and Customs Enforcement, known as ICE. “On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” a spokesperson for the group said. “They have our information, so it’s only fair that we have theirs,” the hackers wrote.

The searchable archive indexes 41,191 people, including 21,329 from Customs and Border Protection and about 10,000 from ICE — a third of them in its investigative arm, Homeland Security Investigations. It also lists more than 55,000 internal permission groups, labels that control who can access which systems, alongside each person’s name, title, office, email, phone number and manager. DDoSecrets co-founder Emma Best said the dataset contains no home addresses.

DHS oversees border protection, immigration enforcement, and cybersecurity — including the Cybersecurity and Infrastructure Security Agency, the federal government’s cyber defense arm — so the file works like a directory of who does what, who reports to whom and how to reach them. Transparency groups say the contact details are useful for public-records requests. Security researchers, however, warn the same list could help anyone seeking to impersonate a supervisor over the phone or work out who sits behind a sensitive investigation.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a department spokesperson said. DHS has also filed a takedown notice through the security firm ZeroFox, asking the domain registrar to stop serving contact and location data of people who did not consent to its publication. With the hackers and Okta offering competing accounts, how the records were obtained remains the central open question — one that any findings from the department’s response or further evidence from the companies could resolve.

The search site built on the data stopped loading Thursday, with its domain showing a registrar hold, and Bluesky is blocking links to the nonprofit hosting the archive. A sample of named employees has been matched to other records, but the full archive has not been verified.

The publication follows a similar episode in September, when the cybercrime group ShinyHunters claimed to hold 2 to 3 terabytes of data on FBI agents and job applicants, prompting the bureau to tell staff to assume hackers have their personal data — making this the second episode in as many months in which hackers have claimed or published personal data tied to U.S. federal employees.

The newest records in the Icepick archive date to Aug. 19, and some entries — including CISA staff who have since left the agency — are already out of date, meaning some listings may no longer reflect who currently holds a given post or phone number.