ICE List website publishes ~4,500 ICE, Border Patrol, and DHS employees in January 2026 data leak

What happened

ICE List launched in June 2025. The operator is Dominick Skinner, an Irish citizen residing in the Netherlands. The site was hosted offshore from the start, outside U.S. jurisdiction by design. The initial release named about 2,000 ICE and Border Patrol officials.

On January 13, 2026, the second wave landed. A DHS whistleblower with internal access handed the operator data on roughly 4,500 additional ICE, Border Patrol, and other DHS employees. The leaked records included names, work emails, phone numbers, job titles, and background data. The trigger was the fatal shooting of Renee Good in Minneapolis days earlier — an event the site cited as the reason for the expanded publication.

Coverage by Wikipedia's ICE List entry and the related DHS employee data leak article reported that the published material across both waves included names, phone numbers, in some cases home addresses, and in some cases vehicle details.

DHS opened an internal investigation. The site stayed up.

How it started

The June 2025 launch and the January 2026 expansion ran on the same model. Insider data plus offshore hosting plus AI-assisted matching.

The AI piece is the part most worth understanding. The operator used AI to verify identities against the leaked records before publishing — cross-referencing names, employee numbers, and corroborating data points to filter out duplicates and obvious errors. That's the part that scales. A human reviewer can verify a few names a day. An AI pipeline can chew through thousands.

The site has been DDoS'd repeatedly. Reporting attributes those attacks to Russian botnets, though attribution at that level is always provisional. The DDoS attempts have not taken the site down for long.

The downstream amplification runs through the standard broker stack. Once a name is published on ICE List, every people-search engine and reverse-lookup tool resells the home address attached to that name. The data classes the site published — name, phone, sometimes home address, sometimes vehicle plate — are the exact classes that get aggregated and resold every day for anyone whose name is known.

Why this case matters

Most public reporting on doxxing of federal officers happens one officer at a time. ICE List collapsed the threat surface for thousands of agents and staff into a single publication. Any actor with a grievance and an internet connection can pick a name off the list and walk it through the standard broker stack to get a home address.

The numbers around it tell the operational story. DHS has reported a roughly 1,000-1,300 percent spike in assaults on ICE personnel during the same window the site has been live. The leak source was internal. The downstream amplification is commercial. The verification layer is AI. The hosting is offshore. None of those four pieces are problems federal LE can solve on the agency side.

Sen. Marsha Blackburn cited the leak when introducing S. 1952, the Protecting Law Enforcement from Doxxing Act, in the weeks after the January 2026 publication. The bill is the first serious federal effort to create something like Daniel's Law for federal officers. As of this writing it has not advanced.

What this means for you

If you're an ICE agent, Border Patrol officer, or any DHS employee whose name might be on the list, the immediate concern isn't whether the site exists. It's that anyone reading it can take the name they got there and look up where you live. That step does not require any technical skill.

The federal Lieu Act covers federal judges. There is no current federal statute that lets federal LE force broker removal the way New Jersey's Daniel's Law lets covered NJ officers and judges sue. Until S. 1952 or a successor passes, the defensive layer is continuous broker removal across every commercial site that lists residences by name.

For more on the doxxing chain and which sites matter most, see /doxxing and /data-brokers.

---

Editorial rules: Only public, already-reported incidents. Never name a non-public victim. Always end with the prevention takeaway tied to our service. Cite at minimum one public source per claim.