Loading story…
A report from Senator Gary Peters highlighted significant cybersecurity and privacy risks stemming from the Department of Governmental Enterprises (DOGE) operating outside federal data governance laws, warning that unrestricted employee access to sensitive data could lead to vulnerabilities and corruption. In parallel, a group of senators introduced the Management of Individuals’ Neural Data Act of 2025, directing the Federal Trade Commission to establish standards for protecting consumers’ neural data from misuse by tech companies and data brokers. The proposed legislation aims to prevent exploitation and manipulation of individuals through unregulated collection and use of brain activity data, emphasizing the need for strong privacy safeguards and oversight. Both actions reflect growing congressional concern over the lack of federal controls on the collection and handling of highly sensitive personal data by both government entities and private companies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Senate Democrats published a report concluding that the Department of Government Efficiency was operating outside federal law and violating cybersecurity and privacy requirements. The report said DOGE's practices were putting Americans' data at risk.
U.S. senators introduced legislation directing the Federal Trade Commission to establish standards for protecting consumers' brain-wave and other neural data. The bill seeks to create privacy safeguards for data collected by neurotechnology devices and related services.
5 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Department of Government Efficiency (DOGE), a federal agency reportedly created by Elon Musk, has come under intense scrutiny for its handling of sensitive personal data belonging to millions of Americans. According to a report by the Senate Homeland Security and Government Affairs Committee Democrats, DOGE has been bypassing established cybersecurity protections at three major federal agencies: the Social Security Administration (SSA), the General Services Administration (GSA), and the Office of Personnel Management (OPM). The committee's findings are based on staff visits, whistleblower disclosures, legal filings, and media reports, all of which point to significant lapses in data security and privacy compliance by DOGE personnel. One particularly alarming incident involved DOGE uploading the Numident database—a file containing highly sensitive personal information—into an environment lacking additional safeguards, which an internal SSA risk review estimated carried a 35% to 65% chance of a data breach with catastrophic consequences. Whistleblowers further alleged that DOGE staff, including Edward Coristine, had the ability to move sensitive SSA data into unmonitored cloud environments, raising the risk of unauthorized access or exfiltration. The Senate report also highlighted that DOGE teams were sometimes denied access to agency offices due to security concerns, and that DOGE personnel had not completed the same cybersecurity training required of other federal employees. In response to these findings, the committee urged federal agencies to revoke DOGE's access to sensitive information until the department demonstrates compliance with privacy laws and cybersecurity best practices. The report has sparked widespread concern about the potential for large-scale data breaches and the misuse of Americans' personal information. The situation is further complicated by the broader context of increasing government surveillance and the aggregation of disparate data streams, as noted by security experts. The risks posed by DOGE's practices are seen as distinct from those of corporate surveillance, with the potential for government misuse of personal data being particularly acute in a techno-authoritarian environment. The revelations have prompted calls for greater oversight, transparency, and accountability in how federal agencies and their contractors handle sensitive data. Lawmakers and privacy advocates are demanding immediate action to mitigate the risks and prevent future incidents. The controversy underscores the critical importance of robust cybersecurity protocols and strict adherence to privacy regulations in all government operations involving personal data. The ongoing investigation and public debate are likely to shape future policy and enforcement actions regarding federal data security. The case also serves as a cautionary tale for other agencies and private sector partners about the dangers of circumventing established cybersecurity safeguards. As the story develops, the focus remains on ensuring that Americans' personal information is protected from both internal and external threats. The incident has also reignited discussions about the balance between efficiency, innovation, and security in government technology initiatives. Ultimately, the DOGE controversy highlights the urgent need for comprehensive reforms to safeguard the privacy and security of citizens' data in the digital age.
Jun 29, 2026
Senator Ted Cruz blocked the passage of the Protecting Americans from Doxing and Political Violence Act, a legislative proposal aimed at extending data privacy protections to all individuals in the United States. The bill, introduced by Senator Ron Wyden, sought to prevent the sale of personal information by data brokers and to enhance protections against stalking, violence, and other criminal threats. Cruz argued that the measure could hinder law enforcement activities, such as tracking sexual predators, and was the sole senator to object to the proposal. The legislation was motivated in part by recent incidents, including the killing of a Minnesota state lawmaker whose personal information was allegedly obtained from data brokers. In addition to blocking the main bill, Cruz also objected to a follow-up measure, S.2852, which would have extended protections to state-level officials, staff, and survivors of domestic violence and sexual assault. Cruz expressed interest in expanding protections but stated that the appropriate approach had not yet been determined. The debate highlights ongoing concerns about the role of data brokers in facilitating privacy breaches and the potential for misuse of personal information. Meanwhile, a separate report from the Atlantic Council proposed that Congress enact a safe-harbor law to shield tech companies from lawsuits related to spyware that exploits their platforms. The report argues that such a law would incentivize companies to invest in spyware detection, victim notification, and information sharing with researchers and advocacy groups. The proposed safe-harbor would apply to messaging platforms, mobile operating systems, cloud service providers, and security companies, provided they implement robust threat detection and notification programs. The report notes that while companies like Apple, Meta, and Google have effective threat hunting teams, there is currently no legal framework to protect them from potential legal repercussions arising from their anti-spyware efforts. The safe-harbor proposal also suggests that less-resourced platforms, such as Signal, could benefit from increased information sharing if larger companies are protected and encouraged to collaborate. Most existing spyware lawsuits have targeted the manufacturers of surveillance tools rather than the platforms exploited by such tools. The legislative and policy discussions reflect a broader debate over how best to balance privacy, security, and accountability in the digital age. Both the blocked data privacy legislation and the proposed safe-harbor law for tech companies underscore the complexity of protecting individuals from digital threats while ensuring that law enforcement and technology providers can operate effectively. The ongoing legal and policy developments are being closely watched by privacy advocates, technology companies, and lawmakers. The outcome of these debates will have significant implications for data privacy, cybersecurity, and the responsibilities of both data brokers and technology platforms. As the landscape evolves, stakeholders continue to grapple with the challenges of regulating data flows and protecting users from harm. The intersection of legislative action and industry self-regulation remains a critical area of focus for the future of cybersecurity and privacy in the United States.
Jun 29, 2026
Sen. Ron Wyden and Rep. Greg Casar have asked the U.S. Government Accountability Office to investigate how federal agencies use hacking tools and spyware against Americans, seeking an unclassified public report on the scope, frequency, safeguards, and legal processes behind those operations. The request targets agencies including the FBI, DEA, ICE Homeland Security Investigations, and the Secret Service, and argues that federal law enforcement has used such capabilities for more than 25 years with far less transparency than exists for traditional wiretap authorities. The lawmakers asked the GAO to examine how agencies acquire and secure hacking tools, whether government personnel have misused them, what is disclosed to courts when warrants are sought, and how Rule 41 authorities are used for court-approved hacking. The push comes amid broader scrutiny of U.S. government spyware practices, including ICE's acknowledged work with spyware firm **Paragon**, and follows concerns that stolen government hacking tools have previously been repurposed by foreign adversaries against **Ukraine** and cryptocurrency users.
Aug 21, 2026