Bluesky blocks links to leaked DHS employee data as government seeks takedowns

Following a sizable leak of personnel data about employees who work for the U.S. Department of Homeland Security, social network Bluesky is now blocking its users from accessing a nonprofit’s website that hosts the leaked dataset.

Users reported that the links to nonprofit transparency collective DDoSecrets were marked as “malicious” soon after TechCrunch and other media outlets broke the news that Homeland Security had been hacked.

TechCrunch reported on Wednesday that a hacker obtained over 40,000 user account records from Homeland Security’s login system, including the names and contact information, such as work-issued phone numbers and email addresses, of employees and agents working for its various agencies like Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE).

The data included information that was similar to that on an employee’s business card. DDoSecrets, which publishes leaked data sets in the public interest, also made the hacked data publicly available. Researchers who are investigating abuses by the Trump administration say that the data will be invaluable for seeking records from the government under public records laws.

A spokesperson for Homeland Security told TechCrunch on Wednesday that it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.” 

Bluesky did not respond to a request for comment outside of U.S. West Coast business hours about the blocks. A Bluesky spokesperson told Wired that the exposed data violates its community guideline rules, but chose to block the link rather than taking down the posts. (We’ll update if we hear back.)

DDoSecrets co-founder and journalist Emma Best told TechCrunch that while Bluesky’s terms of service prohibit sharing home addresses and personal contact information, Best said that neither of these is in the leaked dataset.

“The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher. By requiring the public to provide it for [Freedom of Information Act] requests, the government has made that exact information a crucial piece of the transparency channels they want the public to engage in,” said Best.

Homeland Security sends takedown notices

Best told TechCrunch that a website hosting a searchable copy of the stolen data was taken down by its domain registrar, effectively knocking the website offline for now.

A search site made by journalist, maia arson crimew, no longer loads as of Thursday morning. An internet record associated with the domain says it has been placed on “serverHold,” which generally means that the domain registrar locked or closed the domain for some reason.

Homeland Security filed a takedown notice via a security vendor called ZeroFox, which has authority to act on the department’s behalf until 2028 to seek the removal of data from the internet. TechCrunch has seen a copy of the takedown notice for the search site, which asks that the domain registrar “stop serving the personal contact and location data of individuals who did not consent to its publication.” 

CentralNic, which hosts the domain name, did not respond to a request for comment from TechCrunch about the takedown or whether it was instructed to do so by a government demand. ZeroFox also did not respond to a request for comment. 

The Homeland Security spokesperson did not respond to a follow-up regarding the takedown notice affecting Icepick’s website.

Crimew also made a locally hosted version of the data, allowing anyone to access it on their own computer.