For most of this year, the Department of Homeland Security has fought to keep the identities of its officers private. Agents work in masks. The department has declined to name officers even after violent encounters. On Wednesday, that policy met a single compromised login, and the login won.

A group calling itself the Department of Peace says it broke into an Okta single sign-on service used at DHS, the kind of system that lets an employee log in once and reach many work applications. What it took out was not case files or deportation records. It was something quieter and in some ways more useful: the department's internal directory of people.

The dataset, which its publishers call Icepick, covers roughly 41,000 to 42,000 DHS employees and contractors, about a fifth of the department's workforce. According to reporting by CyberScoop and Straight Arrow News, it includes names, work email addresses, phone numbers and job assignments across Immigration and Customs Enforcement, Customs and Border Protection, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency, Citizenship and Immigration Services, the Federal Protective Service and several smaller offices. Some records carry internal group labels such as "Undercover Operations" and "Covert Operations."

The hackers handed the data to Distributed Denial of Secrets, a nonprofit that publishes leaked material, and to the Swiss hacker and writer maia arson crimew, who built a public search tool that lets anyone look up employees by name, agency, job title and location.

DHS said it was "aware of a potential breach" and working to address it. Okta said it had no evidence its own systems were compromised, which suggests the weak point was a DHS account or configuration rather than the company's platform. That distinction matters to Okta's shareholders. It matters very little to the 41,000 people now searchable.

The group's spokesperson framed the hack as retaliation for the stepped-up immigration crackdown promised by Homeland Security Secretary Markwayne Mullin. DDoSecrets co-founder Emma Best argued the release replaces anonymity with accountability and will feed journalism, congressional oversight, lawsuits and public records requests for years.

The geography is the strategy. Within a day, a DHS contractor, the security firm ZeroFox, asked the site's Icelandic hosting company, FlokiNET, to take the data down. FlokiNET refused, saying the site publishes work identities of government employees and that the public has a legitimate interest in who carries out federal work. A domain registry suspended the original web address. By Thursday the site was back under a different registrar. Bluesky began blocking links to it.

This is the pattern I have written about in other contexts: power belongs to whoever controls the step everyone else depends on. Washington controls the agents, the budgets and the courts. It does not control a server rack in Iceland, a hosting company that answers to Icelandic law, or a publisher that has already copied the data. The earlier and much smaller leak in January, about 4,500 ICE and Border Patrol employees posted to a site run from the Netherlands, followed the same route. DHS promised charges then too. The data stayed up until a denial-of-service attack knocked the site offline.

The law at home is less of a shield than it sounds. The federal statute most often cited against doxxing officers, 18 U.S.C. 119, makes it a crime to publish a covered official's restricted personal information, such as a home address, a home or mobile phone number, or a personal email, with intent to threaten, intimidate or incite violence. Work email addresses are not on that list. Some of the leaked phone numbers may be mobiles, but the law still requires proof of intent, a hard bar to clear against publishers who say their purpose is accountability. The hacking itself is a separate federal crime. Prosecuting it requires finding the hackers, and so far DHS has not said it has.

Both sides of the argument have a real point, and the reader deserves both. Supporters of the leak say officials who carry out immigration enforcement are public servants, not private citizens, and that secrecy around who did what has made accountability almost impossible. They point to Minneapolis, where enforcement operations this year ended in the deaths of two American citizens, and note that the search tool returned records for agents reported to be involved in one of those shootings.

The counterargument is just as concrete. Most of the 41,000 people in this file are not masked agents at a raid. They are analysts, clerks, trainers, cybersecurity staff and contractors, swept up because they had a login. And the "undercover" labels are not a figure of speech. Exposing who works covert assignments can endanger officers and the people they work with, including informants who never agreed to any of this. ZeroFox put it plainly: the data was stolen, and it identifies and locates real people.

What should worry everyone, whatever they think of ICE, is how little it took. No insider smuggled files out. No foreign intelligence service is needed to explain it. One identity system, one breached entry point, and the staff structure of one of the largest departments in the federal government became a search box. Every agency that runs on single sign-on has the same chokepoint.

What is not yet known: how the hackers obtained access, whether any personal home addresses are in the data, whether any employee has been threatened as a result, and whether DHS will be able to name a suspect. Congress has not yet held a hearing. I expect it will.