Bluesky blocks links to leaked DHS employee data as government seeks takedowns

Following a sizable leak of personnel data about employees who work for the U.S. Department of Homeland Security, social network Bluesky is now blocking its users from accessing a nonprofit’s website that hosts the leaked data.

Users reported that the links to nonprofit transparency collective DDoSecrets were marked as “malicious” soon after TechCrunch and other media outlets broke the news that Homeland Security had been hacked.

TechCrunch reported on Wednesday that a hacker obtained over 40,000 user account records from Homeland Security’s login system, including the names and contact information, such as work-issued phone numbers and email addresses, of employees and agents working for its various agencies like Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE).

The data included information that was similar to that on an employee’s business card. DDoSecrets, which publishes leaked data sets in the public interest, also made the hacked data publicly available. Researchers who are investigating abuses by the Trump administration say that the data will be invaluable for seeking records from the government under public access laws.

A spokesperson for Homeland Security told TechCrunch on Wednesday that it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.”

Bluesky did not respond to a request for comment outside of U.S. West Coast business hours about the blocks. A Bluesky spokesperson told Wired that the exposed data violates its community guideline rules, but chose to block the link rather than taking down the posts. (We’ll update if we hear back.)

DDoSecrets co-founder and journalist Emma Best told TechCrunch that while Bluesky’s terms of service prohibit sharing home addresses and personal contact information, Best said that neither of these is in the leaked dataset.

“The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher. By requiring the public to provide it for [Freedom of Information Act] requests, the government has made that exact information a crucial piece of the transparency channels they want the public to engage in,” said Best.

Best told TechCrunch that a website hosting a searchable copy of the stolen data was taken down by its domain registrar, effectively knocking the website offline for now.

A search site made by journalist, maia arson crimew, no longer loads as of Thursday morning. An internet record associated with the domain says it has been placed on “serverHold,” which generally means that the domain registrar locked or closed the domain for some reason.

Homeland Security filed a takedown notice via a security vendor called ZeroFox, which has authority to act on the department’s behalf until 2028 to seek the removal of data from the internet. TechCrunch has seen a copy of the takedown notice for the search site, which asks that the domain registrar “stop serving the personal contact and location data of individuals who did not consent to its publication.”

CentralNic, which hosts the domain name, did not respond to a request for comment from TechCrunch about the takedown or whether it was instructed to do so by a government demand. ZeroFox also did not respond to a request for comment.

The Homeland Security spokesperson did not respond to a follow-up regarding the takedown notice affecting Icepick’s website.

Crimew also made a locally hosted version of the data, allowing anyone to access it on their own computer.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Zack Whittaker

Security Editor

He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected].

November 4

Boston

Buy One Pass, Get a Second Free

Cover more ground at TechCrunch’s ultimate founder bootcamp of the year by bringing your co-founder or partner for free

Book before the BOGO deal expires

VCs will make billions on Anthropic’s IPO, but Amazon is set to make much (much) more

Marina Temkin

Billionaire Palmer Luckey isn’t leaving California over the wealth tax

Julie Bort

Microsoft offers buyouts to around 60,000 employees

Aisha Malik

Grok releases the first seven minutes of its AI-generated ‘Odyssey’

Anthony Ha

The AI graveyard: a running list of projects and startups that didn’t make it

Lauren Forristal

Hottest toy for Christmas? Nvidia CEO plays with adorable Microduck robots, 20,000 sell

Julie Bort

Warhound raises $200M to engineer war dogs and arm them with Anduril gear

Dominic-Madori Davis