The Social Security Administration's chief data officer just went public with explosive allegations that could represent the largest government data breach in U.S. history. Charles Borges claims the Department of Government Efficiency uploaded a live copy of 450 million Social Security records to an inadequately secured cloud server, potentially exposing every American's most sensitive personal data.
The bombshell dropped Tuesday afternoon when Charles Borges, the Social Security Administration's chief data officer, filed a whistleblower complaint that reads like a cybersecurity nightmare. According to Borges, members of the Trump administration's Department of Government Efficiency uploaded the crown jewel of American personal data — the entire Social Security database — to what he describes as a vulnerable Amazon cloud server lacking proper security controls.
The database in question, known as the Numerical Identification System, contains more than 450 million records with some of the most sensitive personal information imaginable: Social Security numbers, family member data, health diagnoses, income levels, banking information, citizenship status, and biographical details for virtually every American. "If this information were compromised, it is possible that the sensitive [personally identifiable information] on every American could be exposed publicly, and shared widely," Borges warned in his complaint.
The controversy traces back to a legal battle that unfolded earlier this year. A federal restraining order initially blocked DOGE staffers from accessing the Social Security database in March, but the Supreme Court lifted that order on June 6, clearing the path for what Borges alleges became a reckless data migration.
Within days of gaining legal access, DOGE operatives — described by Borges as former Elon Musk employees appointed to reduce government fraud and waste — began working to secure internal approvals for the controversial cloud upload. The agency's chief information officer Aram Moghaddassi ultimately signed off, stating he "determined the business need is higher than the security risk" and accepting "all risks" with the project, according to the complaint.
What makes this particularly alarming is the level of access DOGE operatives allegedly obtained. Borges claims they were given administrator privileges to the agency's cloud environment, potentially allowing them to create "publicly accessible services." Translation: they could theoretically expose the cloud system and its treasure trove of sensitive data to the public internet.
The complaint reveals a pattern of security concerns that Borges raised internally before going public. Despite his warnings about violating federal privacy laws and internal security protocols, agency leadership pressed forward with the migration. Michael Russo, a senior DOGE operative who previously served as the agency's chief information officer, also approved the move, adding another layer of internal endorsement to what Borges views as a catastrophic security lapse.
The potential consequences are staggering. If the database were compromised, the complaint suggests a worst-case scenario could require re-issuing Social Security numbers for every American — an administrative and financial nightmare that would dwarf any previous data breach in scale and impact. Previous government cloud security incidents, like the 2023 Department of Defense email exposure involving thousands of military communications, provide a sobering preview of what could go wrong.
The Social Security Administration is pushing back hard against the allegations. Spokesperson Nick Perrine told TechCrunch the agency "stores personal data in secure environments that have robust safeguards in place to protect vital information." He emphasized that the data is stored in "a long-standing environment used by SSA and walled off from the internet" with oversight by the agency's Information Security team. The spokesperson also stated the agency was "not aware of any compromise to this environment."
But Borges' decision to go public through his attorney Andrea Meza at the Government Accountability Project suggests he believes internal channels have failed. His statement urging Congress to "engage in immediate oversight" indicates he views this as an urgent national security issue requiring legislative intervention.
This revelation comes as DOGE has taken sweeping control of most U.S. federal departments and their citizen data repositories since President Trump took office in January. The department has faced previous cybersecurity accusations, including violations of Treasury rules involving unencrypted personal data.
White House spokesperson Elizabeth Huston declined to comment on whether the administration was aware of the complaint, deferring to the Social Security Administration — a response that suggests the controversy may be just beginning to unfold at the highest levels of government.
This whistleblower complaint represents a potential inflection point in the ongoing debate over government cybersecurity practices and oversight of political appointees with sweeping data access. Whether Borges' allegations prove accurate or represent the concerns of a dissenting official, the complaint has already achieved its apparent goal: forcing congressional attention on how the most sensitive American personal data is being handled in the cloud era. The coming weeks will likely determine whether this becomes a footnote in government efficiency efforts or the catalyst for major cybersecurity reforms.
