Key takeaways
- Bluesky and domain registrars blocked access to 40,000+ leaked DHS employee records, though the data remains available through local copies.
- DDoSecrets argues the professional contact information is essential for FOIA requests, since the government itself requires requesters to identify employees by name and agency.
- Homeland Security used ZeroFox, a security vendor, to obtain rapid takedowns from domain registrars without judicial review, achieving removal within days of media reports.
A breach of the Department of Homeland Security‘s login infrastructure exposed over 40,000 employee account records, including work contact information for personnel across agencies like Customs and Border Protection and Immigration and Customs Enforcement. The leaked dataset contained names, work-issued phone numbers, and email addresses. DDoSecrets, a nonprofit dedicated to publishing leaked information in the interest of transparency, made the data publicly available shortly after TechCrunch and other outlets reported on the incident.
Within days of the coverage, the social network Bluesky began blocking its users from accessing DDoSecrets’ archive, marking the first of multiple enforcement actions aimed at suppressing the data’s circulation. Domain registrars received takedown notices, search-accessible versions went offline, and government agencies authorized security vendors to intervene. Yet alternative pathways to the same information persisted, pointing to the practical limits of containing data once it reaches broad distribution.
Platform Blocks and Content Moderation
When users began sharing links to DDoSecrets on Bluesky, the platform flagged those links as “malicious,” preventing most users from accessing them. The blocking appeared almost immediately after media reports emerged.
Bluesky’s justification centered on its community guidelines, which prohibit sharing home addresses and personal contact information without consent. A Bluesky spokesperson told Wired that the exposed data violated those guidelines. Rather than removing posts that mentioned the dataset, Bluesky restricted access to the link itself. The platform did not respond to requests for additional comment from TechCrunch outside West Coast business hours.
The Category Question
DDoSecrets co-founder and journalist Emma Best challenged Bluesky’s application of its policies. While acknowledging that the platform’s terms of service forbid sharing home addresses and personal contact details, Best noted that neither category applied to the dataset. The records contained only professional work contact information—the kind appearing on an employee’s business card. “The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher,” Best told TechCrunch. “By requiring the public to provide it for [Freedom of Information Act] requests, the government has made that exact information a crucial piece of the transparency channels they want the public to engage in.”
A Middle-Ground Approach
By blocking the link rather than removing posts discussing the breach, Bluesky occupied a compromise position. Users could still discuss the incident and its implications without accessing the archive through the platform. The strategy avoided appearing to suppress conversation while still limiting access through the network.
Government Enforcement and Domain Takedowns
Beyond platform-level action, Homeland Security escalated through ZeroFox, a security vendor authorized to act on the agency’s behalf through 2028. ZeroFox filed a takedown notice targeting a searchable database created by journalist maia arson crimew, instructing the domain registrar to “stop serving the personal contact and location data of individuals who did not consent to its publication.”
The domain registrar, CentralNic, subsequently placed the site on “serverHold,” effectively taking it offline. This status generally indicates that the registrar has locked or closed the domain for some reason. CentralNic did not respond to inquiries from TechCrunch about whether it acted under government demand or in response to the ZeroFox notice. ZeroFox also did not respond to requests for comment.
Rapid Infrastructure Action
The use of ZeroFox and domain registrars represented enforcement at the technical infrastructure layer, bypassing the need to work through content platforms or seek judicial approval. By targeting the registrar rather than the hosting provider alone, the government achieved rapid removal of the most visible searchable version of the data. No court proceeding was required, and enforcement moved from media reports to domain registrar action within days.
Persistence of Distributed Copies
The enforcement strategy proved incomplete. Crimew created a locally hosted version of the data that allows users to download and run the database on their own computers. This version circumvents both platform blocks and domain-level restrictions, remaining accessible to anyone with the technical knowledge to set it up locally. The approach demonstrates the persistent challenge of containing information once it enters broad distribution.
Transparency and the FOIA Connection
Researchers investigating potential government abuses flagged the dataset as invaluable for filing Freedom of Information Act requests. The FOIA process itself requires requesters to identify specific employees and their agencies in order to request records. This bureaucratic requirement effectively mandates that the very information now being suppressed remains necessary for citizens to exercise their legal rights to government transparency.
DDoSecrets argued that when the same government pursues takedowns to prevent the information’s circulation, it creates a structural barrier to accessing the public records it is legally required to disclose. Homeland Security acknowledged the breach in a statement to TechCrunch, saying it was “aware of a potential breach and is actively working to address the situation swiftly and effectively,” but did not elaborate on the enforcement actions or their legal basis.
Multiple Layers of Access
Despite Bluesky’s blocks and domain takedowns, the data remains accessible through multiple pathways. Beyond Crimew’s locally hosted version, researchers and journalists have likely archived the information to servers the government has not targeted or stored it offline. The practical challenge of containing information once it enters sufficient distribution became evident within days of the initial reports, as the most visible, easily accessible versions were removed but alternative access points persisted.
The Unresolved Tension
The incident crystallizes a debate about where the boundary lies between protecting privacy and suppressing government information. No federal court has weighed in on the takedown’s legal basis, and the government has not clarified the authority under which ZeroFox and domain registrars were instructed to act. Whether platform blocks and domain takedowns represent appropriate limits on data circulation, or constitute suppression of information essential to government accountability, remains contested.
Source: TechCrunch
Frequently Asked Questions
What exactly was exposed in the DHS breach?
Over 40,000 DHS employee account records containing names, work-issued phone numbers, and email addresses for personnel across agencies like Customs and Border Protection and Immigration and Customs Enforcement.
Why did DDoSecrets publish the data despite the takedowns?
DDoSecrets argued the professional work contact information is essential for citizens filing FOIA requests, since the government itself requires requesters to identify specific employees and agencies to obtain public records.
Can people still access the leaked data?
Yes, through locally hosted versions created by journalist maia arson crimew that users can download and run on their own computers, circumventing both platform blocks and domain registrar takedowns.
