Whistleblower says DOGE placed Social Security data for hundreds of millions at risk

A whistleblower has accused the Department of Government Efficiency (DOGE) of putting hundreds of millions of Americans’ personal data at risk. The data, including names, Social Security numbers, addresses and birth dates, could be used for widespread identity theft if compromised.

Charles Borges, the Social Security Administration’s chief data officer, said DOGE members assigned to his agency uploaded a copy of the sensitive data to a vulnerable cloud server in June. Borges made the allegation Tuesday in a complaint he sent to the Office of Special Counsel and congressional lawmakers. 

“This vulnerable cloud environment,” the complaint said, “contains all data submitted in an application for a United States Social Security card, including the name of the applicant, place and date of birth, citizenship, race and ethnicity, parents’ names and social security numbers, phone number, address and other personal information.”

The cloud server, the complaint added, was only accessible to DOGE and did not include “independent security monitoring” that is normally required at the Social Security Administration for sensitive data storage.

‘Catastrophic impact’

DOGE, which was originally overseen by billionaire Elon Musk, sought to combat fraud, waste and abuse in the federal government on behalf of President Donald Trump. Musk said early on that DOGE needed access to Social Security data because of overwhelming fraud. Experts have refuted such claims.

Borges said that an internal security assessment described DOGE’s actions as “high risk” given the “catastrophic impact” any data exposure would have on Social Security beneficiaries. 

“Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital healthcare and food benefits, and the government may be responsible for re-issuing every American a new Social Security Number at great cost,” the complaint said.

Risk disregarded

According to The New York Times, Borges gathered “two dozen pages of internal emails, memos and other records” to verify his claims. Borges stated that, despite his position as chief data officer, DOGE did not involve him in any discussions regarding the data transfer.

One of the documents obtained by Borges reportedly showed that DOGE was aware of the risks but proceeded with the project nonetheless. Aram Moghaddassi, who previously worked at the Musk-owned companies X and Neuralink, reportedly approved the data transfer in a July 15 memo after determining that “the business need is higher than the security risk.”

Although Moghaddassi wrote that he accepted “all risk,” Borges said the decision to move the sensitive data “potentially violated multiple federal statutes.”

Yet, according to Borges, his complaints and those of other employees fell on deaf ears. The Government Accountability Project, a whistleblower protection organization that is representing Borges, said their client “spent weeks pressing for fixes inside.”

“When nothing changed, he used the protected channels federal whistle-blower law provides,” said Andrea Meza, a lawyer with the organization.

A federal judge temporarily blocked DOGE’s access to the sensitive Social Security data in March. However, the Supreme Court overturned that decision on June 6. 

Borges said that even while access was blocked, DOGE appeared to circumvent the decision before it was locked out once again several days later.