Icepi.cx Is Down, But Icepicx.is Is Live: Government Response to Major Data Breach
On October 29, 2026, news broke that the U.S. government is actively working to eradicate a significant data leak that has identified a multitude of employees within the Department of Homeland Security (DHS), including many who serve in undercover roles. This development follows a major breach involving a self-proclaimed hacktivist group known as the Department of Peace, which recently released sensitive information about more than 41,000 DHS employees.
The government has engaged a cybersecurity firm, ZeroFox, to address this breach. Reports indicate that ZeroFox has been issuing takedown notices to domain registrars and various social media platforms in an effort to restrict access to the leaked data. This includes the removal of any social media posts containing links to this sensitive information.
According to the hacktivist group, they managed to acquire an extensive 165-megabyte dataset dubbed "Icepick." This dataset contains not only the names of employees but also their contact information. The group subsequently shared this dataset with the nonprofit advocacy organization Distributed Denial of Secrets, as well as hacktivist maia arson crimew, who developed an online search tool for the data, originally hosted at the URL icepi.cx.
Emma Best, a co-founder of DDoSecrets, emphasized that the information contained in Icepick is not merely a directory of DHS employees but specifically highlights individuals who are pivotal to DHS policy and operations. This includes members of the controversial Immigration and Customs Enforcement agency, which has faced significant public scrutiny over its actions.
However, the search tool that provided access to this sensitive data has seen fluctuations in availability. Although it was taken down shortly after the breach’s announcement, it soon reappeared at a new web address, icepicx.is. The creator, maia arson crimew, announced this change on the social media platform Bluesky, assuring users that the search tool would remain accessible despite ongoing government efforts to disable it.
In parallel, DDoSecrets took significant steps to further disseminate the information by releasing the source code for the searchable Icepick site as a .zip archive, which they made available on the Torrent peer-to-peer network. This action underlines the ongoing battle between state actors and hacktivists in the digital sphere.
The DHS’s partnership with ZeroFox has become increasingly evident throughout this ordeal, with the firm undertaking various measures to block access to the breached information across social media. This includes takedown notices aimed specifically at protecting the identities of the employees whose information was leaked. As reported by TechCrunch, these notices request domain registrars to cease the dissemination of personal contact and location data that was published without the individuals’ consent.
ZeroFox’s risk assessment elaborated on the potential consequences of this breach, noting that the exposure of such data places individuals, particularly those identified in the leaked documents, at heightened risk of harassment and threats to their physical safety. Importantly, the public exposure of sensitive information such as cell phone numbers and office locations, which is now searchable and widely available, poses a unique challenge for both the government and the affected personnel.
Interestingly, this is not the first foray of the Department of Peace into leaking DHS-related data. Earlier this year, in March, the same group published contractor records that further raised concerns about the security protocols in place for sensitive government data.
The current circumstances surrounding the Icepick breach underscore the complexities of cybersecurity in an age where information dissemination is rapid and often uncontrollable. The DHS’s multilevel response strategy, including engaging third-party cybersecurity firms and employing aggressive takedown strategies, reflects a growing recognition of the risks posed by hacktivism and the existing vulnerabilities within governmental cybersecurity frameworks.
With the stakes rising and the potential repercussions for affected personnel looming large, it remains to be seen how effectively the U.S. government can contain this breach and prevent future incidents of this nature from occurring. As the tension between governmental entities and digital activists continues to unfold, the implications for privacy, security, and individual safety remain pressing issues that require careful attention and robust solutions.