Following a sizable leak of personnel data about employees who work for the U.S. Department of Homeland Security, social network Bluesky is now blocking its users from accessing a nonprofit’s website that hosts the leaked dataset.
Users reported that the links to nonprofit transparency collective DDoSecrets were marked as “malicious” soon after TechCrunch and other media outlets broke the news that Homeland Security had been hacked.
TechCrunch reported on Wednesday that a hacker obtained over 40,000 user account records from Homeland Security’s login system, including the names and contact information, such as work-issued phone numbers and email addresses, of employees and agents working for its various agencies like Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE).
The data included information that was similar to that on an employee’s business card. DDoSecrets, which publishes leaked datasets in the public interest, also made the hacked data publicly available. Researchers who are investigating abuses by the Trump administration say that the data will be invaluable for seeking records from the government under public records laws.
A spokesperson for Homeland Security told TechCrunch on Wednesday that it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.”
In a statement, Bluesky chief operating officer Rose Wang told TechCrunch: “Our Community Guidelines protect people’s safety and privacy by prohibiting the unauthorized sharing of personal information and other content that could pose safety risks. Because the files include the email addresses and phone numbers of individuals, shared without their authorization, we are blocking links to the dataset.”
“When deciding between blocking a link and removing individual posts, we chose to block the links to avoid limiting public discussion or restricting broader access to reporting and commentary,” said Wang.
In a post on Bluesky, Wang said that the company plans to change the wording on the block message. “We should have changed the wording last night. Changes incoming shortly,” said Wang.
DDoSecrets co-founder and journalist Emma Best told TechCrunch that while Bluesky’s terms of service prohibit sharing home addresses and personal contact information, Best said that neither of these is in the leaked dataset.
“The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher. By requiring the public to provide it for [Freedom of Information Act] requests, the government has made that exact information a crucial piece of the transparency channels they want the public to engage in,” said Best.
Homeland Security sends takedown notices
Best told TechCrunch that a website hosting a searchable copy of the stolen data was taken down by its domain registrar, effectively knocking the website offline for now.
A search site, dubbed Icepick, made by journalist maia arson crimew no longer loads as of Thursday morning. An internet record associated with the domain says it has been placed on “serverHold,” which generally means that the domain registrar locked or closed the domain for some reason.
Homeland Security filed a takedown notice via a security vendor called ZeroFox, which has authority to act on the department’s behalf until 2028 to seek the removal of data from the internet. TechCrunch has seen a copy of the takedown notice for the search site, which asks that the domain registrar “stop serving the personal contact and location data of individuals who did not consent to its publication.”
CentralNic, which hosts the domain name, did not respond to a request for comment from TechCrunch about the takedown or whether it was instructed to do so by a government demand. ZeroFox also did not respond to a request for comment.
The Homeland Security spokesperson did not respond to a follow-up regarding the takedown notice affecting Icepick’s website.
Crimew also made a locally hosted version of the data, allowing anyone to access it on their own computer.
Updated with comment from Bluesky.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
