Loading story…
A self-described hacktivist group calling itself “Department of Peace” claimed it breached U.S. Department of Homeland Security (DHS) systems and exfiltrated internal records tied to Immigration and Customs Enforcement (ICE) contracting. The group published the material via the transparency collective Distributed Denial of Secrets (DDoSecrets), and reporting indicates the dataset contains 6,600+ contractor-related records listing thousands of companies associated with federal immigration enforcement contracts, including major vendors such as Microsoft, Oracle, Palantir, Raytheon, and Anduril.
The alleged source of the leaked records was described as DHS’s Office of Industry Partnership, a unit involved in procuring technology from the private sector. As of the reporting cited, DHS had not publicly confirmed the intrusion or validated the authenticity and provenance of the released data, leaving the breach claim unverified while the documents circulate publicly via the DDoSecrets-hosted release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Security researcher Micah Lee created a GitHub-backed page to organize and make the leaked DHS contractor records searchable, including sorting by contract amount. The site highlighted major contracts and made the dataset easier to review.
Hacktivist group "Department of Peace" claimed it compromised U.S. Department of Homeland Security systems and released data allegedly taken from DHS's Office of Industry Partnership. The leak, published on DDoSecrets, reportedly included records tied to DHS and ICE contracts involving more than 6,000 companies and exposed contractor contact details and identifiers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetechrepublic.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ICE List**, a website publishing personal details of U.S. Immigration and Customs Enforcement (ICE) officers and Border Patrol agents, was reported offline following a sustained **distributed denial-of-service (DDoS)** attack that the site’s administrator, Dominick Skinner, attributed to traffic largely originating from **Russia** and routed through proxies. Skinner said the attack’s use of proxy infrastructure made attribution difficult, but described it as unusually long-running and sophisticated; the site is reportedly hosted in the **Netherlands**, complicating potential U.S. takedown efforts. Reporting indicated the disruption followed Skinner’s stated intent to release data on nearly **4,500** immigration personnel allegedly obtained from the U.S. Department of Homeland Security via a whistleblower. The exposed dataset was described as including **names, phone numbers, email addresses, job titles**, and other identifying information, prompting criticism from DHS that the site enables **doxxing** of federal personnel; Skinner reportedly said he planned to withhold some categories of names (e.g., nurses and childcare workers) while publishing most others.
Jun 29, 2026
The US Department of Homeland Security has reportedly used **administrative subpoenas** to pressure tech companies to disclose identifying data about anonymous accounts and individuals critical of the Trump administration, including accounts sharing information about local **ICE immigration raids**. The reporting highlights that administrative subpoenas—unlike judicial subpoenas—do not require a judge’s approval and can seek metadata and account-identifying details (e.g., login times, devices, and associated email addresses), raising concerns about oversight and potential chilling effects on speech. Separately, the anti-ICE alert service **StopICE** reported its app and website were attacked, with users receiving texts claiming their information had been “compromised and sent to the authorities,” alongside disparaging messages about the developer. StopICE administrators and the developer disputed claims that sensitive personal data (names, addresses, GPS/location histories) was stolen, stating the service does not collect/store that information, while also noting the platform faces heavy hostile activity including frequent **DDoS** attempts; the service blamed a **US Customs and Border Protection (CBP)** agent for the attack, though that attribution was not independently confirmed in the reporting.
Jun 29, 2026
Hackers breached the U.S. Department of Homeland Security’s **Homeland Security Information Network (HSIN)**, a platform used to share sensitive but unclassified information with federal, state, local, tribal, territorial, international, and private-sector partners. Internal incident details indicate suspicious activity was detected between mid-May and early June on HSIN and an associated SharePoint environment, including altered files on test and production servers, use of a legitimate web-server program to run malicious code, and deletion of logs. DHS said it isolated affected systems, mitigated the underlying vulnerability, opened a forensic investigation, and maintained that classified networks were not affected and HSIN remained operational. The attackers reportedly remained in the environment for weeks after DHS personnel twice dismissed the activity as false positives. On June 4, the intruders were said to have installed hidden backdoors and stolen credential files before the breach was confirmed. Investigators had not publicly attributed the intrusion, and it remained unclear whether data was exfiltrated, but potentially exposed information may have included event security plans, suspicious activity reports, alerts, persons-of-interest data, and shared operational dashboards. The compromise has raised national security concerns because access to HSIN could support broader intelligence collection, impersonation of trusted partners, targeted spear-phishing, and exposure of emergency and major-event security planning.
Jul 13, 2026