Leaked account-group data appears to reveal which U.S. Department of Homeland Security (DHS) employees received access to websites and services blocked by the agency’s web filters, including artificial intelligence tools, Signal and a facial-recognition application. The data also appears to expose links to senior officials, Customs and Border Protection (CBP) personnel, Immigration and Customs Enforcement (ICE) accounts and Department of Defense employees.
DHS privilege groups include senior officials
Two privilege groups named “Executive Leadership” and “AI Access” appear to list people granted exceptions to DHS web filters that block some employee-facing websites. Both groups include the same 13 people, including former DHS Secretary Kristi Noem and Antoine McCord, DHS’s recently retired chief information officer, who returned to defense technology company Anduril.
Philip Hegseth is listed as a senior adviser to the DHS secretary and is the younger brother of Defense Secretary Pete Hegseth. Jace Krutchenfels, listed as a policy adviser, previously served as a regional field director for Donald Trump’s 2024 presidential campaign, according to his LinkedIn profile.
Noem, McCord, Hegseth and Krutchenfels did not respond to requests for comment.
Leaked groups reference ChatGPT, Gemini and Copilot
Other groups identified in the leaked data reference AI tools including OpenAI’s ChatGPT, Google’s Gemini and Microsoft’s Copilot. One group, titled “Grok.com,” includes eight DHS technology officials, including the agency’s former chief information officer and chief data officer.
“If it’s authentic and up-to-date, this is an invaluable intelligence resource for anyone trying to break into DHS,” said Alexander Leslie, a national security expert at threat intelligence firm Recorded Future.
“This dataset becomes even more valuable when it is associated with previously compromised information, commercial data, and other information collections,” Leslie said. “Attackers can spend months exploiting these relationships to identify vulnerable individuals, develop convincing impersonation attempts, or compromise ongoing investigations.”
CBP accounts linked to Signal and Mobile Fortify
More than 700 accounts are associated with groups that appear to refer to the encrypted messaging app Signal. Nearly all of those accounts belong to CBP officers.
More than 200 CBP accounts belong to a group referring to Mobile Fortify, a facial-recognition app used by immigration officials to identify individuals. The group includes field supervisors, special response team operators, and tactical and intelligence agents. About half of the accounts are based in Texas, California and Arizona.
ICE and military-related account groups
Since July 4, 2025, when President Trump signed the One Big Beautiful Bill Act, approximately 1,300 ICE enforcement accounts have been created. The legislation funded the hiring of 10,000 new ICE enforcement and removal officers by the end of 2025.
Nearly 20 accounts appear to belong to Department of Defense employees, which the government refers to as the Department of the Army. Eight people belong to a group titled “ICE Tip Line DOW Surge.” Approximately 170 accounts are listed as providing “military processing assistance” at ICE facilities, while another 35 accounts explicitly identify members of the National Guard.
Source: www.wired.com