Why the DHS data leak got blocked, promoted and pulled

Hackers who go by the Department of Peace leaked login-system records covering more than 41,000 people who work for or contract with DHS, and the nonprofit Distributed Denial of Secrets (DDoSecrets) published them on a Wednesday. Within about a day, several parties had decided what to do about it, and no two chose the same thing.

Bluesky blocked links. X’s Grok chatbot pointed users to the data. A domain registrar took a search site offline. DHS, meanwhile, went after that site through a security vendor.

What was leaked, and who published it?

The archive, which DDoSecrets calls Icepick, covers DHS and seven component agencies, including ICE and CBP. It holds names, work email addresses, phone numbers, office addresses, job titles and office locations, plus more than 55,000 permission groups that show which internal systems each account can use.

DDoSecrets says the data came from DHS’s Okta single sign-on system. Okta says it has no evidence its data or systems were compromised, so treat the origin as a claim, not a finding. A DHS spokesperson said the department is aware of a possible breach and is working to address it. DHS hasn’t confirmed that the dataset is authentic or how much of it is real.

The hackers gave the files to DDoSecrets and to security researcher and journalist maia arson crimew, who built a searchable site on top of them. According to Engadget, the group tied the leak to a July 17 remark by DHS Secretary Markwayne Mullin about turning up the heat. Ars Technica reports the records were last updated Aug. 19, 2026.

Bluesky blocked the links, not the posts

Bluesky is blocking links to the DDoSecrets archive and to crimew’s search site, but it didn’t delete posts that mention them. Users who tap a link land on a warning page that labels the URL malicious. The company says the files include emails and phone numbers shared without authorization, which breaks its community guidelines.

Chief operating officer Rose Wang explained the choice in terms of speech:

“we chose to block the links to avoid limiting public discussion or restricting broader access to reporting and commentary”

— Rose Wang, COO, Bluesky, via TechCrunch

Wang also said in a post that the company planned to change the block message’s wording, which she said should have been changed the night before. Bluesky hasn’t said whether the block was automatic or whether any government agency asked for it, according to Wired.

Was the Bluesky block justified?

That depends on a factual dispute Bluesky hasn’t settled. The company says the files contain individuals’ emails and phone numbers. DDoSecrets cofounder Emma Best says there are no home addresses or personal contact details, only professional contact information. Wired’s preview saw work-related details, and FIRE attorney Adam Steinbaugh compared the data to what’s found on a business card.

Bluesky’s rules prohibit posting someone’s home address, private contact details, financial or health records, or identity documents. They also explicitly protect factual reporting on government transparency and public officials. Best put the counterargument this way:

“The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher.”

— Emma Best, cofounder, DDoSecrets, via TechCrunch

I think the malicious label was the wrong tool. It’s a security warning, and it’s attached to a policy call about a document dump. Best says it isn’t the first time a platform has done this to DDoSecrets: Twitter suspended the group’s account in 2020 and blocked links after the 269 GB BlueLeaks release.

The block also leaks at the edges. The DDoSecrets homepage still loads from Bluesky, and at least one third-party Bluesky app, Klearsky, opens the links with no warning. Bluesky began in 2019 as a Twitter research project, opened to the public in February 2024 and had 45 million registered accounts by August. A rule enforced in one app, on one network, only goes so far.

Grok pointed the other way

On X, the Grok chatbot sent users straight to the Icepick search site. It described the site as a working, cleaned, searchable tool and said the full dataset can be downloaded from DDoSecrets or by torrent. X didn’t respond to Wired’s request for comment.

A chatbot’s answer isn’t a moderation decision, and no one has reported that X made one. Still, the contrast with Bluesky is hard to miss: one platform blocked the same links a rival’s bot was recommending. One detail adds an odd twist. The leaked permission groups include one named Grok.com, which has eight DHS technology officials in it, among them the department’s previous CIO and its data chief.

The registrar and the ZeroFox notice

The search site went down because of a registrar, not a platform. By Thursday morning the Icepick site no longer loaded, and its domain record showed serverHold, according to Best, who says the registrar took it down. A serverHold stops a domain from resolving without deleting what sits behind it.

TechCrunch saw the trigger: a takedown notice DHS filed through the security vendor ZeroFox, which can act for DHS until 2028. The notice asks the registrar to stop serving personal contact and location data of people who didn’t consent. CentralNic, ZeroFox and DHS didn’t respond to TechCrunch about the takedown, and DHS didn’t answer a follow-up about the site. What legal basis the registrar relied on hasn’t been reported.

This is the layer I’d watch most closely. Bluesky wrote down its reasoning and had to defend it in public within hours. A registrar acting on a vendor’s notice, for an agency, has published nothing at all.

Why the takedowns may not hold

Crimew also built a version of the dataset that people can run on their own machines. Grok mentioned a torrent. DDoSecrets still hosts the archive itself. Taking down one domain doesn’t remove any of that, and the status of the search site may have changed since these reports were written.

The pressure fits a pattern. DHS has tried to identify anonymous critics online and broadened what it counts as doxing, so that publishing employees’ names and titles now qualifies. It has also pursued protester customer records and warrants for surveillance tools aimed at reporters, and the government has moved to hide DHS employees’ names and faces. Steinbaugh says the administration reads 18 USC 119 expansively. Whether DHS or prosecutors will use that law or doxing rules against anyone who hosts or links to this data hasn’t been reported.

What this means for platform teams and anyone with a work login

If you work in trust and safety, the lesson is about mechanics. Link blocks, post removals, chatbot answers and domain holds are different tools with different visibility. Bluesky chose the narrowest one and then used a warning label that didn’t match its stated reason. If your guidelines protect reporting on public officials, your enforcement language should too.

If your job puts you behind single sign-on, take the security warnings seriously. Illumio’s Gary Barlet says the access information is the most worrying part, because it points attackers to both the systems and the people to target. Recorded Future’s Alexander Leslie says the dataset would be a prized intelligence asset for anyone trying to break into the department, but only if it’s genuine and current. An adversary could then find vulnerable employees or impersonate staff. His warning is conditional, and nobody has said how the records were obtained. A hardware security key such as the YubiKey 5 NFC is still a cheap way to harden an account against phishing.

For everyone else, the practical point is simpler. Whether you can click through to a story’s underlying data now depends on which app you use.

Still unanswered

Several basic questions have no answers yet:

• How the hackers got the data, and whether Okta was really the source.
• Whether a government agency asked Bluesky to block the links, and whether the block was automatic.
• Whether the registrar acted on the ZeroFox notice alone, and on what legal basis.
• Whether the data is authentic and current.
• Whether DHS will rotate credentials or change access.
• Who the Department of Peace is, and whether more releases are coming.

Frequently asked questions

Why did Bluesky block links to the DHS leak?

Bluesky says the files include emails and phone numbers shared without authorization, which violates its community guidelines. It blocked links instead of removing posts to avoid limiting discussion of reporting. DDoSecrets cofounder Emma Best says the data holds only professional contact information.

Why did the Icepick search site go offline?

By Thursday morning its domain record showed serverHold, which Best says came from the registrar taking it down. TechCrunch saw a DHS takedown notice filed through ZeroFox. CentralNic, ZeroFox and DHS didn't respond to TechCrunch.

Was Okta hacked in the DHS leak?

DDoSecrets and the hackers say the data came from DHS's Okta single sign-on system. Okta says it has no evidence its data or systems were compromised. How the records were obtained hasn't been established.

Did X block the leak like Bluesky did?

X hasn't said. Its Grok chatbot pointed users to the search site and said the full dataset could be downloaded from DDoSecrets or by torrent. X didn't respond to Wired's comment request.

Sources

This article was compiled from reporting by the following outlets. Links go to the original reports.

1. TechSpot: Hackers leak details of 41,000 Homeland Security employees, exposing undercover operations and surveillance tools
2. Wired: Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
3. SecurityWeek: Over 41,000 DHS Employee Records Leaked Online
4. TechCrunch: Bluesky blocks links to leaked DHS employee data as government seeks takedowns
5. Engadget: Hackers leaked details of more than 41,000 Homeland Security personnel
6. Ars Technica: Massive leak exposes 41,000 DHS workers and undercover ICE agents