Back to overview
Confidence HighJan 13, 2026ice.gov

U.S. Immigration and Customs Enforcement (ICE) Data Leak

PatternExternal actor · Error · Confidentiality impact

An online database containing sensitive information on U.S. Immigration and Customs Enforcement (ICE) department workers was leaked in January 2026. The incident exposed data on 2,000 agents and 150 supervisors, potentially being the largest breach of department staff information. The database itself experienced a cyberattack on January 13, 2026.

Signal date
Jan 13, 2026
Updated
Jun 19, 2026
Confidence
High
Sources
1 source

Signal context

First seen: Jan 13, 2026

Last updated: Jun 19, 2026

Status: Public signal

Key points

  • Sensitive information of ICE agents and supervisors leaked.
  • Affected 2,000 agents and 150 supervisors.
  • Database experienced a cyberattack on January 13, 2026.

Signal analysis

Beta

It helps compare this signal with other published signals without treating the labels as final determinations.

Affected organization
Ice logo
Ice

Likely country: 🇺🇸 United States

inferred from company domain

    Threat source
    Error activity

    The feed marks multiple actor roles. Treat this as a review signal rather than a final attribution.

    • Source type: outside the affected organization
    • Source type: possible insider or internal misuse
    Business impact
    Potential data exposure

    Impact area: Confidentiality

    Likely asset: User or customer data, Server or cloud data store

    Trend context
    12 signals with similar action pattern
    • 1 signal in the same sector
    • 90 signals with the same likely impact area
    • 1 signal linked to this organization/domain
    Mentioned entities
    IceData DisclosureU.S. Immigration and Customs EnforcementICESensitiveAffected

    External sources

    Related signals

    Grouped by why the signal is relevant.

    dialog.org logoDialogJun 27, 2026
    Same action patternSame impact area

    Peter Thiel's Dialog Society Data Leak Exposes Senior US Officials

    A data exposure at Dialog, a private events group co-founded by Peter Thiel, unmasked personal information and login tokens for US and allied national security figures. The incident, which Dialog internally classified as a cyberattack but evidence suggests was a website misconfiguration, exposed private details of 222 registrants for its 2026 retreat, including names, private contact details, active login tokens, and internal ratings.

    viennaairport.com logoViennaairportJun 23, 2026
    Same action patternSame impact area

    Vienna Airport Targeted in APT73/Bashe Ransomware Attack

    The ransomware group APT73/Bashe claimed responsibility for a cyberattack against Vienna Airport (Flughafen Wien AG) on June 23, 2026, threatening to leak sensitive data. The airport acknowledged a limited leakage of old cargo-related files from one email inbox but denied a broader system compromise.

    meta.com logoMetaJun 23, 2026
    Same action patternSame impact area

    Meta Suspends Internal AI Program After Employee Data Leak

    Meta suspended its internal AI program, 'Model Capability Initiative' (MCI), after a data leak exposed sensitive employee information. The program, designed to train AI models, recorded mouse movements, clicks, keystrokes, and took screenshots of employee activity. Problems with data storage were reported in May, leading to the suspension and an ongoing investigation. The incident was publicly reported on June 23, 2026.

    whise.eu logoWhiseJun 23, 2026
    Same action patternSame impact area

    Whise.eu (European Real Estate CRM) Data Leak by ChimeraZ

    The threat actor ChimeraZ claimed to have leaked a database from Whise, a Belgian CRM system for the real estate sector, on the dark web on June 23, 2026. The leaked data reportedly consists of 40.85 million records, approximately 15.8 GB of JSON files. Whise is a market leader in Belgium and also active in France.

    mckaysugar.com.au logoMckaysugarJun 21, 2026
    Same action patternSame impact area

    McKay Sugar Cyber Incident by Gentlemen Ransomware Group

    McKay Sugar, a major Australian sugar producer, suffered a cyber incident that disrupted operations at its Farley and Racecourse Mills. The Gentlemen ransomware group claimed responsibility for the attack around June 15-16, 2026, on their leak site. Public reporting indicated that McKay Sugar was working to verify what data was stolen or accessed. The ransomware group claimed to have stolen over 26 million records containing PII of customers and other internal data. The incident was discussed in public reporting around June 21, 2026.

    msg.com logoMsgJun 21, 2026
    Same action patternSame impact area

    Madison Square Garden Data Leak by ShinyHunters

    The ShinyHunters group reportedly stole and leaked approximately 45 gigabytes of data from Madison Square Garden Entertainment and related entities. The leaked data is said to include corporate and customer information, as well as files referencing New York Knicks players and staff. The incident was reported on June 21, 2026.