On January 16, 2026, the Justice Department filed a notice of corrections to the record in AFSCME v. Social Security Administration, the Maryland lawsuit over Elon Musk's DOGE team's access to Social Security data. The filing acknowledged that statements the government had made to the court in 2025 were incomplete, and it was the administration's first acknowledgment that DOGE staff had handled sensitive Social Security data improperly.
According to the filing, from March 7 to March 17, 2025, members of SSA's DOGE team shared data through links on the third-party server Cloudflare, which “is not approved for storing SSA data,” and SSA “has not been able to determine exactly what data were shared to Cloudflare or whether the data still exist on the server.” On March 3, 2025, a DOGE team member emailed an encrypted, password-protected file that SSA believes contained names and addresses of approximately 1,000 people derived from its systems, copying DOGE senior adviser Steve Davis; SSA has been unable to open the file. One DOGE team member also ran searches of personal data in SSA's copy of the Numident on the morning of March 24, 2025, after a temporary restraining order limiting DOGE's access had been entered.
The filing also disclosed that in March 2025 a political advocacy group asked two DOGE team members to analyze state voter rolls it had acquired. The group's “stated aim was to find evidence of voter fraud and to overturn election results in certain States,” and one of the DOGE members signed a “Voter Data Agreement” with it and sent it on March 24, 2025. The filing said SSA had “not yet seen evidence that SSA data were shared with the advocacy group,” according to CNN. SSA said it learned of the agreement in November 2025, and two Hatch Act referrals were made to the Office of Special Counsel.
The disclosures backed parts of a whistleblower complaint filed in August 2025 by Charles “Chuck” Borges, SSA's chief data officer, who was forced to “involuntarily resign” shortly afterward and later filed a retaliation complaint. Borges told PBS NewsHour the filing validated the first two of his three concerns, inappropriate DOGE access to data and violation of the restraining order. His third allegation, that DOGE uploaded a copy of the Numident, the master database of Americans' Social Security records, to an AWS cloud environment without adequate security controls, “has not yet been validated or refuted,” he said; SSA had denied it. Borges said putting that data at risk is “a risk to literally every single living and dead American's ability to have a daily life.” His lawyer, Debra Katz, said, “If this has happened, these are criminal violations.”
Update (October 2, 2026): In March 2026, NPR reported that SSA's inspector general was reviewing an anonymous complaint about “potential misuse of SSA data by a former DOGE employee,” after The Washington Post reported a whistleblower's claim that a former DOGE engineer said he had kept copies of the Numident and the Death Master File. SSA said the allegations had been “strongly refuted by all named parties.”
Correction (October 2, 2026): This entry said the Justice Department confirmed that DOGE mishandled the Social Security data of every American, including uploading the Numident to unsecured AWS servers. The January 16 filing did not address the AWS allegation, which Borges says remains unconfirmed; it disclosed Cloudflare data sharing, an encrypted email believed to hold data on about 1,000 people, a post-order Numident search and the voter-data agreement. The voter-fraud quotation describes the advocacy group's stated aim, not the employee's agreement. The title, summary and key facts were corrected.