In June 2025, the Supreme Court let DOGE staff access Social Security Administration records while a lawsuit proceeded. Seven months later, the Justice Department filed a “Notice of Corrections to the Record” in that same case. In it, SSA said its DOGE team had used an unapproved third-party service, Cloudflare, to share data in March 2025, and that SSA could not determine exactly what data was shared or whether it still exists. Separately, whistleblowers have alleged that a copy of a national Social Security database was placed in a cloud environment without proper authorization, and that a former DOGE employee kept copies of sensitive data. SSA disputes those allegations, and none has been proven. This post separates three things: what the government admitted in court, what whistleblowers allege, and what is still under investigation.
The legal backdrop
On Apr. 17, 2025, Judge Ellen Lipton Hollander (D. Md.) preliminarily blocked SSA from giving DOGE affiliates access to various SSA records, subject to exceptions. On June 6, 2025, the Supreme Court stayed that order in a brief ruling, concluding that “under the present circumstances, SSA may proceed to afford members of the SSA DOGE Team access to the agency records in question” (SSA v. AFSCME, No. 24A1063). On Apr. 10, 2026, the full Fourth Circuit vacated the preliminary injunction and returned the case to the district court, finding the plaintiffs hadn’t shown likely irreparable harm on the record then before that court (No. 25-1411).
What the government admitted (Jan. 16, 2026 filing)
The Notice of Corrections was filed by DOJ attorneys on SSA’s behalf. The attorneys note that the information was relayed to them by SSA, and that SSA’s review is ongoing. According to the filing (ECF 197, AFSCME v. SSA, No. 1:25-cv-00596):
- Cloudflare links, Mar. 7–17, 2025. Members of SSA’s DOGE team “were using links to share data through the third-party server ‘Cloudflare,'” which “is not approved for storing SSA data.” SSA says it “has not been able to determine exactly what data were shared to Cloudflare or whether the data still exist on the server.”
- An encrypted file sent outside SSA, Mar. 3, 2025. An SSA DOGE team member emailed the Department of Homeland Security and copied a then-senior adviser to the U.S. DOGE Service Temporary Organization and a DOGE-affiliated Labor Department employee. The email attached an encrypted, password-protected file that SSA “believes” contained personal data derived from SSA systems, including names and addresses of approximately 1,000 people. SSA says it has been unable to open the file to confirm its contents, and that it is unclear whether the password was shared with the two copied recipients.
- Searches on the morning of Mar. 24, 2025. SSA’s then-commissioner had declared that DOGE team members’ access to systems with personal data was revoked “as of” Mar. 24. SSA now says one DOGE team member ran searches of personal data on SSA’s copy of the Numident that morning, the last at about 9:30 a.m. ET, before access was cut off around noon.
- Access granted after the court’s restraining order. One DOGE team member was granted access to data schemas containing personal data on Mar. 26, 2025 (revoked Apr. 2); SSA says that access was never used. Another was granted a call-center profile that allowed access to personal data from Apr. 9 to June 11, 2025; SSA says it is unknown whether any personal data was accessed.
- A “Voter Data Agreement.” SSA said a political advocacy group contacted two DOGE team members in March 2025 asking for help analyzing state voter rolls, with the stated aim of finding evidence of voter fraud and overturning election results in certain states. One team member signed a “Voter Data Agreement” with the group in his capacity as an SSA employee, without agency review. SSA says it “has not yet seen evidence that SSA data were shared with the advocacy group.” In late December 2025, SSA made two Hatch Act referrals to the U.S. Office of Special Counsel.
What a whistleblower alleged (Aug. 26, 2025)
Charles Borges, then SSA’s chief data officer, filed a whistleblower disclosure through the Government Accountability Project (redacted disclosure). He alleges that DOGE-affiliated staff had a copy of SSA’s NUMIDENT database, which holds records on more than 300 million people, placed in a cloud environment without proper authorization. These are allegations, not findings.
SSA’s response: In a September 2025 letter to Senate Finance Committee Chair Mike Crapo, SSA Commissioner Frank Bisignano said the acting chief information security officer found the allegation “unfounded,” that the location in question “is actually a secured server in the agency’s cloud infrastructure, which historically has housed this data,” and that SSA found no sign the data was accessed or leaked (FedScoop).
What is under investigation (March 2026)
On Mar. 6, 2026, SSA’s Office of the Inspector General told several congressional committees it is reviewing an anonymous complaint “on matters relating to the potential misuse of SSA data by a former DOGE employee, among other allegations.” The OIG declined to share more, saying doing so could jeopardize any investigation (NPR). Reporting on a separate whistleblower account alleges the former employee claimed to have kept copies of databases including NUMIDENT. An SSA spokesperson told NPR the allegations “have been strongly refuted by all named parties — SSA, the former employee, and the company.” We are not naming the former employee. As of Oct. 17, 2026, we have not found any public findings from the OIG review.
What we still don’t know
- Exactly what data, if any, passed through Cloudflare, and whether it still exists anywhere. SSA itself says it can’t determine this.
- What the encrypted Mar. 3, 2025 attachment actually contained, and whether anyone outside SSA opened it.
- Whether any SSA data has been misused. No court or inspector general has found that it was.
- Whether anyone has been or will be notified under the Privacy Act.
Follow it yourself
- Track AFSCME v. SSA (D. Md. No. 1:25-cv-00596) on CourtListener and set a free RECAP alert for new filings.
- Watch the SSA Office of the Inspector General for published reports.
- Ask your members of Congress whether they have received updates from SSA or its inspector general.
Sources
- DOJ, Notice of Corrections to the Record, AFSCME v. SSA, ECF 197 (Jan. 16, 2026)
- Supreme Court, SSA v. AFSCME, No. 24A1063 (June 6, 2025)
- Fourth Circuit (en banc), AFSCME v. SSA, No. 25-1411 (Apr. 10, 2026)
- Government Accountability Project, Borges disclosure (redacted), Aug. 26, 2025
- FedScoop, “SSA chief’s response to whistleblower complaint” (Sept. 17, 2025)
- NPR, “New investigations look at DOGE and Social Security data” (Mar. 11, 2026)
