Massive DHS Data Leak Exposes Personnel and Undercover Agents
Compromised Department of Homeland Security Database Exposes Personnel and Undercover Agents
The exposed records lay bare internal permission groups, encrypted messaging app associations, and sensitive operational tools utilized across the agency.
The Tech TL;DR:
- A leaked dataset exposes DHS records, detailing internal communication groups, AI tool exceptions, and personnel assignments.
- More than 700 accounts are linked to Signal, while more than 200 Customs and Border Protection accounts connect to the Mobile Fortify facial recognition tool.
- Security researchers warn that the dataset provides a high-value blueprint for adversaries seeking to map internal relationships and mount impersonation attacks.
Executive Leadership and AI Access Exceptions Listed in Leak
The leaked files reveal two permission groups named “Executive Leadership” and “AI Access” that appear to list individuals granted exceptions to the agency’s web filter restricting employee internet access. Both groups contain the exact same 13 people. These include former DHS head Kristi Noem; Antoine McCord, the recently departed DHS chief information officer who has returned to defense tech company Anduril; Philip Hegseth, listed as a senior adviser to the DHS secretary and the younger brother of Defense Secretary Pete Hegseth; and Jayce Krachenfels, listed as a policy adviser, who previously worked as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile, arstechnica.com reported. Noem, McCord, Hegseth, and Krachenfels did not respond to requests for comment.
Additional groups within the data reference enterprise artificial intelligence tools, such as OpenAI’s ChatGPT, Google’s Gemini, and Microsoft’s Copilot. One specific group titled “Grok.com” contains eight DHS technology officials, including the department’s former chief information officer and chief data officer. Alexander Leslie, a national security expert at Recorded Future, evaluated the implications of the breach.
If authentic and current, this is an extraordinarily valuable intelligence resource for those seeking to penetrate DHS. This dataset becomes way more valuable when correlated with previously compromised information, commercial data, and other intelligence collections. An adversary could spend months exploiting these relationships to identify vulnerable personnel, develop convincing impersonation attempts, or compromise ongoing investigations.
Signal and Facial Recognition App Groups Tied to Field Personnel
The leak details extensive use of external communication and tactical applications by field staff. More than 700 accounts link to a group referencing the encrypted messaging application Signal, with nearly all belonging to Customs and Border Protection personnel. More than 200 CBP accounts connect to a group referencing Mobile Fortify, a facial recognition tool used by immigration agents to identify individuals in the field. This latter group includes field supervisors, special response team operators, and tactical and intelligence agents, with approximately half operating in Texas, California, and Arizona.
Roughly 1,300 ICE enforcement accounts have been established since July 4, 2025, following the signing of the One Big Beautiful Bill Act by Donald Trump, legislation that funded the hiring of 10,000 new ICE Enforcement and Removal officers by the end of 2025. The data also identifies nearly 20 accounts belonging to Department of Defense personnel—styled by the administration as the Department of War—including eight listed in a group titled “ICE Tip Line DOW Surge.” Approximately 170 accounts provide military processing support at ICE facilities, and 35 explicitly identify National Guard members.
Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.