Headlines say hackers exposed the identities of more than 40,000 Homeland Security "agents." The reporting supports something narrower and still serious: a searchable database of roughly 40,000 personnel records, which DHS has so far called only a "potential breach." Nobody has publicly confirmed the records are genuine.

What was actually released?

On Wednesday a group calling itself the "Department of Peace" said it had pulled DHS personnel files, according to NPR's report as carried by KZYX. The group gave the data to Distributed Denial of Secrets, which posted it as a database called "Icepick." NPR says about 21,000 records identify Customs and Border Protection employees and about 10,000 relate to ICE, including Homeland Security Investigations.

Add those two together and you get about 31,000, not 40,000. A roundup of the coverage credits the BBC with "nearly 6,600" for ICE alone and lists about 1,000 for CISA, the cyber agency, plus an unspecified number from the Federal Protective Service. No outlet I could open accounts for every record.

The headline total versus the components outlets name. The ICE and ICE-plus-HSI figures overlap, and no source reconciles them. Chart built by PatriotAddict from figures in NPR and a coverage roundup.

Is "40,000 agents" the right number?

It is a record count, and outlets disagree on it. A summary of 11 outlets' framing shows "about 40,000," "more than 41,000" and "tens of thousands." It also shows WIRED putting the files at about a seventh of the DHS workforce, while NPR says about a fifth. Those cannot both hold with the same headcount.

Records are not the same thing as undercover officers, either. The files are described as covering CBP, ICE, cyber and senior staff, with some contractors and associates in the mix. A single person can also appear more than once, which the roundup raises as a possible reason the counts differ.

What has DHS said, and what has Okta said?

The hackers say they got in by abusing Okta's single sign-on service, per NPR. Okta denies its systems were hit. DHS has not said whether the files are real, how many people are affected, or whether staff are being notified. That leaves the central claim, that these are authentic DHS records, resting on the hackers and the publisher.

CBP officers inspect a shipping container at a port of entry in Seattle. File photo, not connected to the leak. Photographer: Donna Burton, U.S. Customs and Border Protection via Wikimedia Commons, public domain.

What is exposed, and what is not?

Accounts differ on the fields. NPR says names, phone numbers and addresses. A report on Yahoo News says names, work addresses, phone numbers and descriptions of each person's work. The roundup lists work email, titles and office locations and says it found no reporting of home addresses or Social Security numbers. I could not inspect the data, and I am not linking to it.

The Yahoo report adds that the files name dozens of previously unknown operations, the agents who led them, and tools such as Palantir and Cellebrite. If that is accurate, the operational exposure may matter more than the headcount.

Why this lands before the midterms

The group tied the leak to a July remark by Homeland Security Secretary Markwayne Mullin about "turning up the heat." NPR notes DDoSecrets cofounder Emma Best said the release links officials who oversee covert operations with personnel in the deportation program. Journalist Ryan Ottignon told NPR he rejects the charge that he is doxxing government employees.

Whatever the final count, the risk to the people on that list is real for anyone whose name, title and phone number are now searchable. An earlier leak this year was reported by ABC News 4 as exposing about 4,500 DHS and ICE agents. This one is roughly nine times that size by the headline figure. Watch for two things this week: whether DHS confirms the data is real, and whether it tells employees.

Header photo: a Border Patrol agent from the McAllen Station horse patrol unit in South Texas. File photo, not connected to the leak. Photographer: Donna Burton, U.S. Customs and Border Protection via Wikimedia Commons, public domain. Cropped and resized.