Cybersecurity Policy Report, DOGE Caused ‘Alarming’ Data Breach at NLRB, Whistleblower Says, (Apr 15, 2025)

By Tom Leithauser

Personnel from the White House Department of Government Efficiency (DOGE) caused a data breach at the National Labor Relations Board that might have exposed agency data to foreign adversaries, according to a whistleblower complaint sent yesterday to leaders of the Senate Intelligence Committee and the U.S. Office of Special Counsel.

The complaint was submitted by Whistleblower Aid, a nonprofit that represents government whistleblowers, and Compass Rose Legal Group on behalf of Daniel Berulis, an NLRB employee specializing in technology issues.

The complaint, addressed to Sens. Tom Cotton (R., Ark.) and Mark Warner (D., Va.), the chairman and vice chairman, respectively, of the Intelligence Committee, included a sworn declaration by Mr. Berulis that described “DOGE activity within NLRB, the exfiltration of data from NLRB systems, and—concerningly—near real-time access by users in Russia.”

“Notably, within minutes of DOGE personnel creating user accounts in NLRB systems, on multiple occasions someone or something within Russia attempted to login using all of the valid credentials (eg. Usernames/Passwords),” the complaint says.

“This, combined with verifiable data being systematically exfiltrated to unknown servers within the continental United States—and perhaps abroad—merits investigation,” it says.

“As you are certainly aware, the practical, legal, and national security implications of such an intrusion are vast. At bare minimum, the conduct here violates the Federal Information Security Modernization Act (‘FISMA’) and guidelines set forth by the Cybersecurity and Infrastructure Security Agency (‘CISA’) and National Institute of Standards and Technology (‘NIST’). Moreover, this breach—at the very least—exposes Privacy Act-protected information,” it adds.

In his declaration, Mr. Berulis describes the arrival of the DOGE team at NLRB in February and notes that he was instructed to give them a high level of access to the agency’s systems. He was told “that there were to be no logs or records made of the accounts created for DOGE employees,” he said.

In March, he discovered unusual activity on the systems he was responsible for monitoring, including a large amount of data being transmitted outside of NLRB’s networks, he said.

“In the days after DOGE accessed NLRB’s systems, we noticed a user with an IP address in Primorskiy Krai, Russia started trying to log in. Those attempts were blocked, but they were especially alarming,” Mr. Berulis reported.

“Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating,” he said.

“There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers,” he added.

The whistleblower complaint also claims that, while Mr. Berulis was preparing his declaration on April 7, a threatening note was taped to his front door along with drone images of him walking in his neighborhood.

“The threatening note made clear reference to this very disclosure he was preparing for you, as the proper oversight authority. While we do not know specifically who did this, we can only speculate that it involved someone with the ability to access NLRB systems,” the complaint says.

“This ‘meat space’ action—where a threat was physically delivered to my client’s home—is absolutely disturbing in its manner and the implications suggested therein,” it adds. “Accordingly, we have been and will continue to be coordinating with appropriate law enforcement agencies.”

Representatives for DOGE and Sens. Cotton and Warner had no immediate response to requests for comment.

MainStory: TopStory FederalLegislation DataSecurity DataBreach