3 ms·

Data breach: DOGE 'accidentally' leaked the whole Social Security database [pdf]

125 points by chirau 8mo ago

sentrysapper 8mo ago
Department of Government Exfiltration.
gigatexal 8mo ago
And get there will be no justice for such egregious failures of duty and Elon will go forward to become a trillionaire. What a gaggle of idiots and fools this admin is
garyfirestorm 8mo ago
I haven’t yet figured out where it says that in the document. Would like to understand the content in the document that relays the headline here.
- ubercore 8mo ago
  Yeah my eyes started to glaze over a bit at the legal wording, but I didn't see anything about leaking the whole database.
- kittenhoarder 8mo ago
  1) Accessed Social Security PII after a court order supposedly cut that access. SSA told the court that all DOGE access to personally identifiable information (PII) was revoked by March 24, 2025. That turned out to be false: a DOGE member ran PII searches the morning of March 24, stopping only around 9:30 a.m.; access was not fully cut until about noon. 2) Sent SSA data to a DOGE official outside SSA. On March 3, 2025, an SSA DOGE member emailed an encrypted file believed to contain names and addresses of ~1,000 people to Steve Davis, a senior advisor to the U.S. DOGE organization (and a DOL employee). The file likely contained data derived from SSA systems of record. It is unknown whether Davis received the password or accessed it. 3) Was given PII access during the TRO even though this was barred. One DOGE member was granted access to 10 PII databases from March 26 to April 2 (never used, but still improper). Another received a call-center profile that could access PII from April 9 to June 11; whether PII was viewed is unknown. 4) Had broader systems access than the court was told. SSA discovered additional access that had not been disclosed earlier, including: Systems containing SSA employee records. Systems controlling building/IT badge access. Shared workspaces that could pool sensitive data. A data-visualization tool that could reach PII. Additional data-warehouse schemas. 5) Engaged in partisan election-related work inside SSA. In March 2025, a political advocacy group asked two DOGE members to analyze state voter rolls to try to overturn election results. One DOGE member signed a “Voter Data Agreement” as an SSA employee with that group on March 24, without agency approval. SSA later referred this conduct to the U.S. Office of Special Counsel for possible Hatch Act violations. 6) Used an unapproved third-party server to share SSA data. From March 7–17, 2025, DOGE members used Cloudflare links to transfer data. Cloudflare is not authorized for SSA data storage; SSA still does not know what data were sent or whether it remains on that server.
  - thegreatpeter 8mo ago
    Still looking for the part about leaking the entire database of SSns
fuoqi 8mo ago
Hopefully, it will result in finally dropping use of SSNs as "secret" identifying person's identity and instead it will become an opaque ID which is safe to share.
- jve 8mo ago
  As I am someone from EU, please explain me what can you do with this SSN number? I mean is it like a unique database row id which happens to be a non-changeable-lifetime password which is stored in multiple places in plain-text and you can use it to... "unlock some doors"? Make legally binding agreements remotely... ? Or what? Or it is PII - privately identifying information which is more of a privacy issue here?
  - Coneylake 8mo ago
    Yes, to all of the above, unfortunately
  - estearum 8mo ago
    As an example, if you call your bank to report a lost credit card, and that you'd like it shipped to a different address than the one you registered with them, they'll ask you for the last 4 digits of your SSN. So yeah, someone who knows (name, SSN) or especially (name, address, phone, SSN) can do a lot of harm.
  - nerdsniper 8mo ago
    It's used for all sorts of "prove you are who you are" situations. It's most commonly associated with applying for credit/loans, and taxes, but definitely not limited to those things. It's ridiculous that an immutable 8-digit number + name is used for authentication in the USA. It even says on the card "FOR SOCIAL SECURITY AND TAX PURPOSES - NOT FOR IDENTIFICATION" but apparently we've all lost our minds and ignore that. It can be very difficult to go through business processes if you refuse to give your SSN - some healthcare providers will just refuse to serve you. With it, people can take out loans in your name, get into your accounts, file fake tax returns and get tax refunds in your name, and generally act as if they're you. Things are getting a little better nowadays (with additional information required) but we still don't have a secure method of identification online / over the phone.
NedF 8mo ago
[dead]
trhway 8mo ago
fun read: "in March 2025, a political advocacy group contacted two members of SSA’s DOGE Team with a request to analyze state voter rolls that the advocacy group had acquired. The advocacy group’s stated aim was to find evidence of voter fraud and to overturn election results in certain States. "
mellosouls 8mo ago
Without any explanatory context this is a completely and inappropriately editorialised submission.
- jagged-chisel 8mo ago
  I request that you contribute to the conversation by explaining the editorialization that you see.
  - mellosouls 8mo ago
    SSA tells court its DOGE team may have exceeded approved data controls Far more representative than the exaggeration posted. It's really not that difficult to post in good faith and let other people make their mind up. This isn't Reddit or X. btw op has since acknowledged the mistake and submitted another pdf: https://news.ycombinator.com/item?id=46899288 https://news.ycombinator.com/item?id=46899288 A more appropriate title for that upload (not the original we were discussing) might be, eg.: Whistleblower: DOGE created cloud copy of Social Security database without proper security controls Note that even that is appropriately more cautious than the original title here. But please see HN guidelines wrt editorializing if you're unsure.
jmclnx 8mo ago
Not that it was already out that with past breaches. One example was the Experian breach, anyone who applied for a loan was already out there. Never mind all the other too many to count breaches that have occurred. Just now with DOGE we have 1 stop shopping. Now that the US Gov. got to join that club we know there will be no consequences. Until execs from companies like Experian and now the US Gov. faces real Jail time, this will happen over and over. I have not heard of a large breach from a Company for a while, are these so common that news orgs. no longer bother to report them ?
chirau 8mo ago
CONTEXT: I forgot to include the background to this court case. In 2025, the Chief Data Officer of the SSA, Mr Borges, whistleblew that DOGE had unlawfully uploaded a whole copy of NUMIDENT (the SSA datastore) to an insecure server. Here is the filing from Mr Borges. https://whistleblower.org/wp-content/uploads/2025/08/08-26-2025-Borges-Disclosure-Sanitized.pdf https://whistleblower.org/wp-content/uploads/2025/08/08-26-2...
ChrisArchitect 8mo ago
Previously: https://news.ycombinator.com/item?id=46707507 https://news.ycombinator.com/item?id=46707507 https://news.ycombinator.com/item?id=46696654 https://news.ycombinator.com/item?id=46696654
josefritzishere 8mo ago
This seems like fodder for a Class Action lawsuit. There was a complete lack of stewardship and they filed a false report with the court.
vikkymelani 8mo ago
[dead]

125 points by chirau 8mo ago

Department of Government Exfiltration.

And get there will be no justice for such egregious failures of duty and Elon will go forward to become a trillionaire. What a gaggle of idiots and fools this admin is

garyfirestorm 8mo ago

I haven’t yet figured out where it says that in the document. Would like to understand the content in the document that relays the headline here.

ubercore 8mo ago
Yeah my eyes started to glaze over a bit at the legal wording, but I didn't see anything about leaking the whole database.
kittenhoarder 8mo ago
1) Accessed Social Security PII after a court order supposedly cut that access. SSA told the court that all DOGE access to personally identifiable information (PII) was revoked by March 24, 2025. That turned out to be false: a DOGE member ran PII searches the morning of March 24, stopping only around 9:30 a.m.; access was not fully cut until about noon. 2) Sent SSA data to a DOGE official outside SSA. On March 3, 2025, an SSA DOGE member emailed an encrypted file believed to contain names and addresses of ~1,000 people to Steve Davis, a senior advisor to the U.S. DOGE organization (and a DOL employee). The file likely contained data derived from SSA systems of record. It is unknown whether Davis received the password or accessed it. 3) Was given PII access during the TRO even though this was barred. One DOGE member was granted access to 10 PII databases from March 26 to April 2 (never used, but still improper). Another received a call-center profile that could access PII from April 9 to June 11; whether PII was viewed is unknown. 4) Had broader systems access than the court was told. SSA discovered additional access that had not been disclosed earlier, including: Systems containing SSA employee records. Systems controlling building/IT badge access. Shared workspaces that could pool sensitive data. A data-visualization tool that could reach PII. Additional data-warehouse schemas. 5) Engaged in partisan election-related work inside SSA. In March 2025, a political advocacy group asked two DOGE members to analyze state voter rolls to try to overturn election results. One DOGE member signed a “Voter Data Agreement” as an SSA employee with that group on March 24, without agency approval. SSA later referred this conduct to the U.S. Office of Special Counsel for possible Hatch Act violations. 6) Used an unapproved third-party server to share SSA data. From March 7–17, 2025, DOGE members used Cloudflare links to transfer data. Cloudflare is not authorized for SSA data storage; SSA still does not know what data were sent or whether it remains on that server.
- thegreatpeter 8mo ago
  Still looking for the part about leaking the entire database of SSns

fuoqi 8mo ago

Hopefully, it will result in finally dropping use of SSNs as "secret" identifying person's identity and instead it will become an opaque ID which is safe to share.

jve 8mo ago
As I am someone from EU, please explain me what can you do with this SSN number? I mean is it like a unique database row id which happens to be a non-changeable-lifetime password which is stored in multiple places in plain-text and you can use it to... "unlock some doors"? Make legally binding agreements remotely... ? Or what? Or it is PII - privately identifying information which is more of a privacy issue here?
- Coneylake 8mo ago
  Yes, to all of the above, unfortunately
- estearum 8mo ago
  As an example, if you call your bank to report a lost credit card, and that you'd like it shipped to a different address than the one you registered with them, they'll ask you for the last 4 digits of your SSN. So yeah, someone who knows (name, SSN) or especially (name, address, phone, SSN) can do a lot of harm.
- nerdsniper 8mo ago
  It's used for all sorts of "prove you are who you are" situations. It's most commonly associated with applying for credit/loans, and taxes, but definitely not limited to those things. It's ridiculous that an immutable 8-digit number + name is used for authentication in the USA. It even says on the card "FOR SOCIAL SECURITY AND TAX PURPOSES - NOT FOR IDENTIFICATION" but apparently we've all lost our minds and ignore that. It can be very difficult to go through business processes if you refuse to give your SSN - some healthcare providers will just refuse to serve you. With it, people can take out loans in your name, get into your accounts, file fake tax returns and get tax refunds in your name, and generally act as if they're you. Things are getting a little better nowadays (with additional information required) but we still don't have a secure method of identification online / over the phone.

NedF 8mo ago

[dead]

trhway 8mo ago

fun read: "in March 2025, a political advocacy group contacted two members of SSA’s DOGE Team with a request to analyze state voter rolls that the advocacy group had acquired. The advocacy group’s stated aim was to find evidence of voter fraud and to overturn election results in certain States. "

mellosouls 8mo ago

Without any explanatory context this is a completely and inappropriately editorialised submission.

jagged-chisel 8mo ago
I request that you contribute to the conversation by explaining the editorialization that you see.
- mellosouls 8mo ago
  SSA tells court its DOGE team may have exceeded approved data controls Far more representative than the exaggeration posted. It's really not that difficult to post in good faith and let other people make their mind up. This isn't Reddit or X. btw op has since acknowledged the mistake and submitted another pdf: https://news.ycombinator.com/item?id=46899288 https://news.ycombinator.com/item?id=46899288 A more appropriate title for that upload (not the original we were discussing) might be, eg.: Whistleblower: DOGE created cloud copy of Social Security database without proper security controls Note that even that is appropriately more cautious than the original title here. But please see HN guidelines wrt editorializing if you're unsure.

jmclnx 8mo ago

Not that it was already out that with past breaches. One example was the Experian breach, anyone who applied for a loan was already out there. Never mind all the other too many to count breaches that have occurred. Just now with DOGE we have 1 stop shopping. Now that the US Gov. got to join that club we know there will be no consequences. Until execs from companies like Experian and now the US Gov. faces real Jail time, this will happen over and over. I have not heard of a large breach from a Company for a while, are these so common that news orgs. no longer bother to report them ?

chirau 8mo ago

CONTEXT: I forgot to include the background to this court case. In 2025, the Chief Data Officer of the SSA, Mr Borges, whistleblew that DOGE had unlawfully uploaded a whole copy of NUMIDENT (the SSA datastore) to an insecure server. Here is the filing from Mr Borges. https://whistleblower.org/wp-content/uploads/2025/08/08-26-2025-Borges-Disclosure-Sanitized.pdf https://whistleblower.org/wp-content/uploads/2025/08/08-26-2...

ChrisArchitect 8mo ago

Previously: https://news.ycombinator.com/item?id=46707507 https://news.ycombinator.com/item?id=46707507 https://news.ycombinator.com/item?id=46696654 https://news.ycombinator.com/item?id=46696654

josefritzishere 8mo ago

This seems like fodder for a Class Action lawsuit. There was a complete lack of stewardship and they filed a false report with the court.

vikkymelani 8mo ago

[dead]