Whistleblower Says DOGE Handling Put Social Security Data of More Than 300 Million Americans at Risk
A senior Social Security Administration official alleged in August 2025 that personnel associated with the U.S. DOGE Service had placed a copy of one of the government's most sensitive identity databases in a cloud environment without the independent security controls and oversight normally required for such information.
The whistleblower was Charles "Chuck" Borges, then the Social Security Administration's chief data officer. His protected disclosure, submitted to the U.S. Office of Special Counsel and congressional committees on August 26, 2025, said the handling of the data could put information connected to more than 300 million people at risk.
The disclosure did not establish that hackers had stolen the database, that the information had been publicly leaked, or that hundreds of millions of Americans had already suffered identity theft. Borges' central allegation was that DOGE personnel created a live copy of Social Security's Numerical Identification System, known as NUMIDENT, in an environment that he said lacked adequate independent monitoring and access controls.
That distinction is important. The episode was a serious alleged data-security failure, but describing it as a confirmed breach of hundreds of millions of records goes beyond what the August 2025 whistleblower disclosure established.
What the Whistleblower Actually Alleged
According to Borges' disclosure, the controversy centered on a June 2025 project to move NUMIDENT data into a virtual private cloud within the Social Security Administration's Amazon Web Services infrastructure.
The documents attached to his complaint said that on June 10, DOGE-associated employee John Solly asked agency technology staff to establish a cloud environment into which NUMIDENT information could be transferred. The proposal subsequently expanded to include administrative access and a replica of production data in a development environment.
An internal risk assessment described the proposed arrangement as high or very high risk. Borges said the concern was not simply that the government was using cloud technology, but that an exceptionally sensitive production dataset could be copied into an environment without the usual independent security monitoring, audit controls and separation of responsibilities.
Borges alleged that the arrangement created "enormous vulnerabilities" and that, as of late June 2025, there was no verified audit mechanism allowing him to determine who had accessed the copy or what had been done with it.
What Is NUMIDENT?
NUMIDENT is a core Social Security Administration database containing information submitted in connection with applications for Social Security numbers. The database includes identifying information such as names, Social Security numbers, dates and places of birth, citizenship information and information about parents.
Because Social Security numbers and related biographical details are difficult or impossible for individuals to change routinely, unauthorized access to such information can create long-term identity-theft and fraud risks.
Borges warned that a compromise of the copied data could have severe consequences. His complaint discussed the possibility that widespread compromise could force the government to consider replacing Social Security numbers, but that was presented as a potential worst-case consequence rather than something the government had decided to do.
Edward Coristine's Role — and What the Evidence Does Not Show
A DOGE Engineer Connected to the Cloud Project
Edward Coristine, the young DOGE engineer widely known by the online nickname "Big Balls," was connected to the project, according to records cited in reporting on Borges' disclosure. Those records indicated that Coristine was among the personnel who would receive access to the cloud environment.
However, the available evidence does not support portraying Coristine as the whistleblower, nor does Borges' complaint establish that Coristine personally stole, leaked or independently uploaded the entire Social Security database. The whistleblower was Borges, and his allegations concerned broader decisions and actions by DOGE-associated and SSA technology officials.
Coristine had previously attracted scrutiny because of his unusually young age and access to federal technology systems. Reuters also reported in March 2025 that a company Coristine operated while in high school had provided network services used by a cybercrime group. That reporting did not establish that Coristine participated in the group's crimes.
The controversy therefore raised legitimate questions about vetting and privileged access, but claims of criminal conduct require evidence beyond association or prior technical relationships.
SSA's Response: No Known Breach at the Time
When the allegations became public in August 2025, the Social Security Administration disputed the implication that Americans' information had been exposed to outsiders. The agency said its personal data was stored in secure environments with safeguards and that the environment referenced in the complaint was within longstanding SSA infrastructure and separated from the public internet.
The agency did not, at that point, announce that the NUMIDENT copy had been hacked or publicly disclosed. Earlier in 2025, then-Acting Commissioner Lee Dudek had also said DOGE personnel working at the agency were required to follow federal law and were subject to restrictions on access to personally identifiable information.
The dispute was therefore partly about the difference between a confirmed external breach and the creation of an internal copy under security conditions that a senior agency data official considered dangerously inadequate.
Court Orders Had Already Limited DOGE Access
DOGE access to Social Security data had already become the subject of federal litigation months before Borges' complaint.
In March 2025, a federal judge temporarily restricted DOGE personnel from accessing certain Social Security systems containing personally identifiable information. In response to that order, SSA filed a declaration stating that DOGE team members' access to systems containing personal data had been revoked and that non-anonymized information previously obtained from SSA systems was to be deleted where required by the court.
The litigation later reached the Supreme Court. On June 6, 2025, the Court stayed the lower-court order while the case proceeded, allowing expanded access to resume while the underlying legal dispute continued. Borges' disclosure said the cloud-copy project began only days later.
The episode unfolded amid wider scrutiny of the Trump administration's approach to federal personnel management and the access DOGE personnel were receiving to government databases.
Why the Security Controls Matter
Large government databases are commonly protected by overlapping controls: access restrictions, audit logs, approval procedures, separation of duties, continuous monitoring and limits on copying production data into development environments.
Those protections matter even when information remains inside government infrastructure. A poorly monitored copy can increase the number of places from which information might be accessed, make unauthorized activity harder to detect and weaken investigators' ability to reconstruct what happened after an incident.
Borges' allegations therefore focused heavily on governance and auditability. His concern was that an extraordinarily valuable dataset had allegedly been placed under the control of a small group without the independent oversight normally expected for high-value federal information.
Cybersecurity incidents involving privileged insiders can be especially difficult to detect because the users may already possess legitimate credentials. That is why monitoring privileged access is a central part of modern security programs.
What Information Was Potentially at Risk?
The August 2025 complaint specifically centered on NUMIDENT rather than every database maintained by Social Security. That distinction corrects an important overstatement in early descriptions of the controversy.
NUMIDENT contains information associated with Social Security number applications, including identifying and biographical data. The whistleblower disclosure did not establish that every piece of medical, banking, benefit-payment and tax information held elsewhere by SSA had been copied into the disputed cloud environment.
Social Security does possess other highly sensitive records across its systems, which is one reason DOGE's wider access generated substantial litigation and congressional scrutiny. But those broader holdings should not be treated as proof that every category was included in the specific NUMIDENT copy described by Borges.
The controversy followed other high-profile concerns about government and technology-sector data handling, including other major data breaches.
Later Developments Added Evidence of Broader Data-Handling Problems
Later developments materially changed the public record. In January 2026, the Justice Department disclosed in federal court that DOGE personnel at SSA had engaged in additional data-handling practices that agency leadership had not previously understood, including transmitting sensitive information through an unapproved third-party service.
Those later disclosures lent support to Borges' broader warnings that SSA leadership did not have complete visibility into all DOGE data activity. They still did not prove that the entire NUMIDENT database had been stolen by hackers or publicly released.
By 2026, congressional investigators were continuing to seek information about DOGE access and data-security practices at SSA, while the agency's inspector general was also examining separate allegations involving possible misuse of sensitive Social Security data by a former DOGE worker.
What Remains Confirmed, Alleged and Unresolved
- Confirmed: Charles Borges, then SSA's chief data officer, filed a protected whistleblower disclosure on August 26, 2025.
- Confirmed: The disclosure concerned a copy of NUMIDENT placed in an SSA cloud environment after DOGE sought expanded access.
- Confirmed: Internal documents described the proposed arrangement as high or very high risk.
- Alleged by Borges: The copied database lacked adequate independent security monitoring and audit controls.
- Not established by the August complaint: That hackers stole the database, that the entire database was released publicly, or that more than 300 million people had already suffered identity theft.
- Not established: That Edward Coristine single-handedly carried out the transfer or committed a criminal data theft.
- Later confirmed in separate government disclosures: DOGE personnel had engaged in additional handling and transmission of sensitive SSA information that raised privacy and security concerns.
The Larger Issue: Who Controls Access to Federal Data?
The Social Security controversy became part of a broader legal and policy debate over how much access DOGE personnel should receive to highly sensitive federal databases and what oversight should accompany that access.
Supporters of the administration's efficiency initiative argued that access to government records was necessary to investigate fraud, waste and improper payments. Critics, including lawmakers, unions, privacy advocates and some career officials, argued that unusually broad access could violate privacy rules and weaken longstanding security protections.
The most important factual takeaway is narrower than the dramatic early headlines: a senior SSA official alleged that DOGE-linked personnel copied one of the country's most sensitive identity databases into a cloud environment under security arrangements he regarded as dangerously inadequate. The allegations triggered oversight and were later followed by additional government disclosures about questionable data-handling practices. But the evidence available at the time did not show that the entire database had been stolen or leaked to the public.
Read More:
- Pentagon Purge Escalates: Intelligence Chief Fired Over Iran Assessment That Contradicted Trump's Claims
- Trump's Unprecedented Fed Power Grab: Lisa Cook Firing Sparks Constitutional Crisis Over Central Bank Independence
- Federal Government Accused of Coercing Guilty Plea Through Uganda Deportation Threat: Legal Experts Question Constitutional Due Process
- Google Chrome Changes Its Extension Strategy To Stop Dishonest Affiliate Marketing
0 Comments