DHS asks Icelandic host FlokiNET to remove leaked data on 40,000 staff

The United States Department of Homeland Security (DHS) has asked an Icelandic web hosting company to take down a site holding information about tens of thousands of its employees — a request the firm says it refused.

FlokiNET posted on Thursday a letter it received from the cybersecurity firm ZeroFox, acting on behalf of DHS. The letter accused FlokiNET of violating its terms of service by publishing a "stolen" employee dataset and asked it to "remove or disable" the material.

"The content is live and places more than 40,000 identifiable individuals at risk of harassment, stalking, and physical harm," the letter said.

Hosting firm cites public interest

FlokiNET said the request concerned one domain, icepi.cx, which had compiled information about employees from a range of DHS agencies, including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).

Those agencies have come under intense scrutiny since President Donald Trump began his mass deportation campaign in 2025. The administration has often refused to identify DHS agents involved in specific operations, citing safety risks.

FlokiNET said it would not comply, and defended that decision in a statement posted online. "Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out," the company said. "The public has a legitimate interest in knowing who is doing that work, under whose authority, and in which office."

The company added that the site's registrar ultimately suspended the domain, after which the employee information moved to a different domain.

Data spreads beyond one site

The database was first posted online on Wednesday by Distributed Denial of Secrets (DDoSecrets), a group that showcases leaked government data. In the past, DDoSecrets has released emails from convicted sex offender Jeffrey Epstein, as well as information from the Israeli Ministry of Justice and police departments in the US.

A hacker group calling itself the "Department of Peace" has claimed responsibility for obtaining and sharing the DHS data. Since first publication, other groups have spread the information elsewhere, including on sites such as icepi.cx. As a result, the information is unlikely to be entirely scrubbed from the internet.

Earlier pressure on platforms

The Trump administration has taken an aggressive approach to online platforms purporting to contain information about ICE employees and other agents involved in immigration operations. Last year, the US Department of Justice pressured tech giants such as Apple to remove apps that track ICE agents, including one called ICEBlock.

The move sparked backlash from Democrats and free-speech advocates. Democratic Representative Jamie Raskin wrote to Apple asking it to review the decision, arguing that blocking access to the apps at the federal government's request raised "the distinct possibility that Apple is working with government to violate its customers' First Amendment right to record and report on the activities of their government."

Immigration agents have also taken steps to conceal their identities during operations, including wearing face masks or street clothes — a lack of transparency that human rights groups and immigration advocates say leaves them little recourse to pursue allegations of excessive force or impropriety during ICE raids.

Since Trump was sworn in for a second term, at least 25 people have faced gunfire from immigration agents, and six of those shootings have resulted in deaths. Other cases have involved alleged violations of civil liberties, including unlawful arrests and racial profiling, as well as controversial tactics such as car ramming and tackling.

Source: Al Jazeera.