DOGE uploaded live copy of Social Security database to ‘vulnerable’ cloud server, says whistleblower

A whistleblower from the Social Security Administration has raised alarming concerns about the potential compromise of sensitive personal information following the uploading of millions of Social Security records to a vulnerable cloud server. Charles Borges, the agency's chief data officer, claims that officials from the Trump administration's Department of Government Efficiency (DOGE) approved this action despite warnings about its security risks. In a whistleblower complaint made public on Tuesday, Borges detailed that in June, agency leaders sanctioned the transfer of a live copy of the Numerical Identification System, which houses over 450 million records. This database includes critical details such as names, birthplaces, citizenship statuses, and Social Security numbers of applicants and their family members. Borges expressed that the decision to upload these records to an Amazon-hosted agency cloud server lacked necessary security measures, making it susceptible to unauthorized access. He emphasized that this move contravened both internal agency protocols and federal privacy regulations. With DOGE personnel managing the cloud environment, the potential existed for sensitive data to be publicly accessible. The whistleblower warned that any breach could result in the exposure of personal details for every American, including health information, income levels, and financial data. The repercussions of such a compromise could be catastrophic for the Social Security program, possibly necessitating a nationwide reissuance of Social Security numbers. While a federal restraining order initially prevented DOGE staff from accessing the database, the Supreme Court lifted this order on June 6, which allowed them to proceed with their plans. Borges noted that following this decision, DOGE sought approvals from top agency officials, including Aram Moghaddassi, the chief information officer, who deemed the security risk acceptable given the business need. Despite Borges’s internal warnings about the risks, he felt compelled to go public by reaching out to Congress, urging immediate oversight of the situation. This incident adds to a growing list of allegations regarding lax cybersecurity practices under the current administration. The Social Security Administration has responded, asserting that it maintains strict security measures to protect personal data and that it was unaware of any breaches. However, concerns remain as data breaches, though infrequent, have occurred within federal agencies, raising questions about the integrity of sensitive information stored in cloud environments.