DOJ Notice Says DOGE Team Members Shared SSA Data Through Cloudflare, a Server Not Approved for SSA Data; the NUMIDENT-Copy Allegation Remains the Whistleblower's

The Department of Justice filed a Notice of Corrections in AFSCME v. SSA (D. Md.) on January 16, 2026; CNN published its report on January 20. The Notice says SSA has learned that DOGE Team members shared data through links on the third-party server Cloudflare, and that “Cloudflare is not approved for storing SSA data.” SSA says it “has not been able to determine exactly what data were shared to Cloudflare.” CNN called the filing the administration’s first acknowledgement that DOGE employees inappropriately handled sensitive Social Security data; that characterization is CNN’s, not the filing’s.

The Notice also discloses an encrypted, password-protected file emailed to the Department of Homeland Security that SSA believes held names and addresses of approximately 1,000 people, and that SSA has been unable to open. It discloses that one DOGE Team member ran PII searches on SSA’s own copy of the Numident on the morning of March 24, 2025, before access was cut at about noon, and that SSA granted DOGE Team members PII access after the TRO, on March 26, 2025 (which SSA says was never used) and April 9, 2025 (a call-center profile; SSA does not know whether PII was accessed).

What is the whistleblower’s allegation, not the filing’s

Charles Borges, SSA’s former chief data officer, “warned in a whistleblower complaint that DOGE employees put the records of more than 300 million Americans at risk” by creating a copy of the agency database in a vulnerable cloud server, CNN reported; the agency denied the claim and Borges “involuntarily” resigned. The Notice does not describe such a copy. Borges told PBS that the filing validates part of his disclosure, and “The third piece has not yet been validated or refuted yet with any documentation.” Of the 300 million figure he said “that was just initial news reporting.”

On January 20, Reps. John Larson and Richard Neal demanded a criminal investigation and wrote that the matter “could very well be the largest data breach in our nation’s history.” That is their characterization of the whole episode, including the whistleblower’s allegation; the Notice itself does not size a breach.