Cybersecurity Policy Report, Social Security Chief Disputes Whistleblower’s Claim About DOGE Data Breach, (Sep 18, 2025)
Organizations Mentioned:Social Security Administration
The Social Security Administration (SSA) is disputing a whistleblower’s claim that some of the SSA’s most sensitive data was copied to a high-risk database by personnel from the White House Department of Government Efficiency (DOGE).
The Numerical Identification System (NUMIDENT) database, which contains personal data of everyone who ever applied for a Social Security number, is secure and remains subject to standard SSA data protections, SSA Commissioner Frank Bisignano said.
“I can confirm, based on the agency’s thorough review, that neither the Numident database nor any of its data has been accessed, leaked, hacked, or shared in any unauthorized fashion. SSA continuously monitors its systems for any signs of unauthorized access or data compromise, and we have not detected any such incidents involving the Numident database,” Mr. Bisignano said in a letter to Sen. Mike Crapo (R., Idaho), chairman of the Senate Finance Committee.
Mr. Bisignano was responding to a letter from Sen. Crapo that requested an immediate assessment of the claims by whistleblower Charles Borges, SSA’s former chief data officer (CPR, Aug. 26).
“In his complaint against the agency, Mr. Borges described alleged shortfalls in how SSA safeguards personally identifiable information (PII) in a test cloud environment, including how the agency governs access, management, and storage of such sensitive information,” Sen. Crapo noted.
“Mr. Borges further alleged that his attempts to report his security concerns to his superiors were ignored, which in turn created a hostile work environment and culminated in his resignation from the SSA on August 29,” he said.
“As Chairman of the Senate Committee on Finance (‘Committee’), I must take very seriously every allegation made by a protected whistleblower. Further, given the large amount of sensitive data under SSA’s control, I consider the protection and security of PII held by the agency to be a matter of first importance,” Sen. Crapo told Mr. Bisignano.
“As an immediate first step, considering the seriousness of Mr. Borges’ allegations concerning SSA’s ability to safeguard data collected and maintained by the agency, please inform the Committee on Finance immediately upon receipt of this letter whether the Numident database itself or any data contained in the Numident was accessed, leaked, hacked, or disseminated in any unauthorized fashion,” he requested.
Mr. Bisignano responded that “key staff, including the Acting Chief Information Security Officer (CISO), Chief Information Officers, and Chief Legal Counsel” reviewed Mr. Borges’ allegations and determined they were “unfounded.”
“The location referred to in the whistleblower allegation is actually a secured server in the agency’s cloud infrastructure which historically has housed this data and is continuously monitored and overseen—SSA’s standard practice,” he told Sen. Crapo.
In addition, the DOGE personnel assigned to SSA had clearance to access sensitive data, and their training and activities “did not diverge from standard agency processes,” he said.
“All employees are required to go through a vetting process prior to being granted access to SSA information systems,” Mr. Bisignano added. “Based on their job functions, employees are granted the appropriate permissions to perform their work.”
MainStory: TopStory FederalLegislation DataSecurity DataPrivacy