Bluesky blocks links to leaked DHS employee data as government seeks takedowns

Key points

• Bluesky is blocking links to DDoSecrets, which hosts leaked DHS employee data.
• A hacker obtained over 40,000 DHS user account records, including work contact details.
• DHS filed a takedown notice via ZeroFox to remove a searchable copy of the data.

Bluesky is blocking its users from accessing links to DDoSecrets, a nonprofit that hosts a leaked dataset of U.S. Department of Homeland Security employee data. Users reported the links were marked as "malicious" after media outlets reported that Homeland Security had been hacked.

TechCrunch reported Wednesday that a hacker obtained over 40,000 user account records from Homeland Security's login system. The data included names and work contact information, such as work-issued phone numbers and email addresses, for employees and agents at agencies including Customs and Border Protection and Immigration and Customs Enforcement.

Responses from parties involved

A Homeland Security spokesperson told TechCrunch it was "aware of a potential breach and is actively working to address the situation swiftly and effectively." Bluesky did not respond to a request for comment outside U.S. West Coast business hours. A Bluesky spokesperson told Wired that the exposed data violates its community guideline rules, but the platform chose to block the link rather than take down the posts.

DDoSecrets co-founder and journalist Emma Best told TechCrunch that Bluesky's terms of service prohibit sharing home addresses and personal contact information, but neither is in the leaked dataset. Best said the data contains professional contact information for government employees at a time when public interest in that information is high.

The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher.

— Emma Best

Takedown and site status

Best told TechCrunch that a website hosting a searchable copy of the stolen data was taken down by its domain registrar, knocking the site offline for now. A search site made by journalist maia arson crimew no longer loads as of Thursday morning, and an internet record says the domain has been placed on "serverHold."

Homeland Security filed a takedown notice through security vendor ZeroFox, which can act on the department's behalf until 2028. The notice asks the domain registrar to "stop serving the personal contact and location data of individuals who did not consent to its publication." CentralNic, which hosts the domain name, and ZeroFox did not respond to requests for comment. Crimew also made a locally hosted version of the data.