Loading story…
The Department of Government Efficiency (DOGE), a federal agency reportedly created by Elon Musk, has come under intense scrutiny for its handling of sensitive personal data belonging to millions of Americans. According to a report by the Senate Homeland Security and Government Affairs Committee Democrats, DOGE has been bypassing established cybersecurity protections at three major federal agencies: the Social Security Administration (SSA), the General Services Administration (GSA), and the Office of Personnel Management (OPM). The committee's findings are based on staff visits, whistleblower disclosures, legal filings, and media reports, all of which point to significant lapses in data security and privacy compliance by DOGE personnel. One particularly alarming incident involved DOGE uploading the Numident database—a file containing highly sensitive personal information—into an environment lacking additional safeguards, which an internal SSA risk review estimated carried a 35% to 65% chance of a data breach with catastrophic consequences. Whistleblowers further alleged that DOGE staff, including Edward Coristine, had the ability to move sensitive SSA data into unmonitored cloud environments, raising the risk of unauthorized access or exfiltration. The Senate report also highlighted that DOGE teams were sometimes denied access to agency offices due to security concerns, and that DOGE personnel had not completed the same cybersecurity training required of other federal employees. In response to these findings, the committee urged federal agencies to revoke DOGE's access to sensitive information until the department demonstrates compliance with privacy laws and cybersecurity best practices. The report has sparked widespread concern about the potential for large-scale data breaches and the misuse of Americans' personal information. The situation is further complicated by the broader context of increasing government surveillance and the aggregation of disparate data streams, as noted by security experts. The risks posed by DOGE's practices are seen as distinct from those of corporate surveillance, with the potential for government misuse of personal data being particularly acute in a techno-authoritarian environment. The revelations have prompted calls for greater oversight, transparency, and accountability in how federal agencies and their contractors handle sensitive data. Lawmakers and privacy advocates are demanding immediate action to mitigate the risks and prevent future incidents. The controversy underscores the critical importance of robust cybersecurity protocols and strict adherence to privacy regulations in all government operations involving personal data. The ongoing investigation and public debate are likely to shape future policy and enforcement actions regarding federal data security. The case also serves as a cautionary tale for other agencies and private sector partners about the dangers of circumventing established cybersecurity safeguards. As the story develops, the focus remains on ensuring that Americans' personal information is protected from both internal and external threats. The incident has also reignited discussions about the balance between efficiency, innovation, and security in government technology initiatives. Ultimately, the DOGE controversy highlights the urgent need for comprehensive reforms to safeguard the privacy and security of citizens' data in the digital age.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
19 events from the most recent confirmed update back to the earliest known activity.
A report published on 2026-05-27 said an investigator identified about 40 federal-looking websites in certificate records that were allegedly registered to the White House and routed through a shared Cloudflare account tied to the National Design Studio. The findings also raised questions about data collection practices on TrumpRx and linked studio personnel to DOGE-related federal technology roles.
Sen. Gary Peters pushed for a new investigation into DOGE's access to Social Security Administration data. The move expanded congressional scrutiny of DOGE's handling of sensitive federal personal data to the SSA.
A whistleblower alleged that a DOGE member took Social Security Administration data on a thumb drive. The claim marked a concrete allegation of removable-media data exfiltration involving sensitive SSA records and appears to have preceded later calls for an investigation.
Leaked communications indicated that the A7 group used stablecoins, including Tether and a ruble-backed token, at large scale to evade Russia-related sanctions. The activity was also alleged to support interference in Moldova’s election.
Mandiant reported on a stealthy backdoor campaign dubbed Brickstorm and attributed it to the China-nexus group UNC5221. The campaign emphasized long-term access on devices that lacked traditional endpoint detection and response coverage.
Microsoft said it disabled certain cloud storage and AI services used by the Israeli military after an external investigation into allegations that Azure had been used for mass surveillance. Reporting indicated the affected data may have been moved to Amazon infrastructure and outside the EU.
Attackers behind a ransomware incident affecting the Kido preschool chain claimed to have stolen personal data and photos relating to about 8,000 children. The group was also reported to be directly pressuring parents as part of the extortion effort.
Call-recording app Neon paused operations after researchers discovered insecure access controls that exposed other users’ phone numbers, recordings, and transcripts. The finding revealed that users could access sensitive data belonging to other customers.
The doxxing-focused app Cancel the Hate leaked its own users’ email addresses and phone numbers because of broken privacy settings and other web security flaws. The exposure affected people using the service rather than its intended targets.
A Senate Democratic report said DOGE poses a threat to Americans’ personal data. The reference indicates a formal political and policy response raising concerns about privacy and data security risks.
A DOGE staffer reported to have access to Americans' personal data leaked a private xAI API key, creating a new operational security concern around DOGE personnel handling sensitive systems and data. The incident added concrete evidence of risky security practices beyond earlier warnings about DOGE access.
The New York Times reported that the Trump administration enlisted Palantir in an effort to compile data on Americans. The development marked a new expansion of federal data aggregation concerns beyond earlier DOGE-specific access disputes at individual agencies.
Democrats raised concerns that DOGE may have violated privacy and cybersecurity law by taking data from the National Labor Relations Board. The development expanded scrutiny of DOGE beyond Treasury and Interior-related access issues to another federal agency's sensitive data.
The Department of the Interior fired senior leaders following an internal conflict over DOGE access to a key federal payroll system. The action marked an escalation from earlier warnings about DOGE access by showing concrete personnel consequences inside a federal agency.
A DOGE staffer reportedly violated Treasury security rules by sending unencrypted personal data over email. The incident provided a concrete example of sensitive data mishandling tied to DOGE access at the Treasury Department.
A longtime General Services Administration employee reportedly resigned instead of giving a Musk ally access to Notify.gov. The episode marked an early DOGE-linked access dispute at GSA and showed personnel fallout tied to control of a federal messaging platform.
A lawsuit alleged the Office of Personnel Management deployed a government-wide email system without first issuing a legally sufficient privacy impact assessment. Plaintiffs sought to halt operation of the system used to send federal employees a delayed resignation offer, adding a new OPM-focused legal challenge tied to privacy and data handling concerns.
Treasury officials said DOGE team member Marko Elez was mistakenly granted read/write access to the Secure Payment System on 2025-02-05, despite prior assurances that DOGE access was read-only. Treasury said initial forensic review found no evidence he altered the system, though log review was still ongoing.
A U.S. senator warned of national security risks after Elon Musk's DOGE was reportedly granted full access to sensitive Treasury systems. The development raised concerns about exposure of highly sensitive government financial and personal data.
19 references tracked. Mallory keeps watching after this page renders.
boingboing.net
Open sourcenextgov.com
Open sourcefedscoop.com
Open sourcewashingtonpost.com
Open sourcenextgov.com
Open sourcepolitico.com
Open sourcetechcrunch.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A whistleblower complaint alleges a former employee associated with Elon Musk’s **Department of Government Efficiency (DOGE)** improperly accessed and removed highly sensitive U.S. Social Security Administration (SSA) data, storing it on a thumb drive and later claiming he brought the data to a new job. Reporting indicates the individual told colleagues at a government contractor that he possessed two tightly restricted SSA datasets—**Numident** and the **Master Death File**—and planned to use or share the information at his new employer; the datasets reportedly contain large-scale personally identifiable information (PII) such as Social Security numbers and birth details. The SSA’s **Office of Inspector General** is investigating the allegations and has reportedly notified members of Congress, according to correspondence reviewed by *The Washington Post* and sources familiar with the matter. The reporting frames the alleged conduct as a potentially unprecedented breach of SSA security protocols and notes it follows earlier concerns and legal claims about DOGE-linked access to restricted Social Security data and handling of large volumes of SSA records.
Jun 29, 2026
A report from Senator Gary Peters highlighted significant cybersecurity and privacy risks stemming from the Department of Governmental Enterprises (DOGE) operating outside federal data governance laws, warning that unrestricted employee access to sensitive data could lead to vulnerabilities and corruption. In parallel, a group of senators introduced the Management of Individuals’ Neural Data Act of 2025, directing the Federal Trade Commission to establish standards for protecting consumers’ neural data from misuse by tech companies and data brokers. The proposed legislation aims to prevent exploitation and manipulation of individuals through unregulated collection and use of brain activity data, emphasizing the need for strong privacy safeguards and oversight. Both actions reflect growing congressional concern over the lack of federal controls on the collection and handling of highly sensitive personal data by both government entities and private companies.
Jun 29, 2026
Court filings in ongoing litigation over the Department of Government Efficiency (DOGE) access to Social Security Administration (SSA) data describe a March 2025 outreach from a political advocacy group seeking help analyzing state voter rolls it had obtained, with the stated goal of finding voter fraud and overturning election results in certain states. According to a Justice Department correction signed by civil division official Elizabeth Shapiro, two DOGE associates at SSA were contacted, and one signed and sent a “Voter Data Agreement” that was not processed through SSA’s normal data-exchange approval procedures; SSA later discovered the agreement during an unrelated internal review. The filings say SSA has not seen evidence that SSA data were actually shared with the advocacy group, but communications suggest DOGE team members could have been asked to access SSA data to match against voter rolls, potentially involving Social Security numbers and use of unapproved third-party infrastructure. SSA made referrals to the Office of Special Counsel for potential **Hatch Act** violations tied to the alleged political activity, while the broader dispute over DOGE’s access to SSA data continues and has prompted corrections to prior SSA testimony in court.
Jun 29, 2026