Bluesky restricts DDoSecrets links following DHS personnel data leak

Bluesky has begun blocking links to the nonprofit transparency collective DDoSecrets after a breach involving the U.S. Department of Homeland Security exposed more than 40,000 account records from the department’s login system. Users reported that DDoSecrets links were labelled “malicious” shortly after news of the incident emerged.

The leaked records reportedly include names and professional contact details, such as work-issued telephone numbers and email addresses, for employees and agents across Homeland Security agencies including Customs and Border Protection and Immigration and Customs Enforcement. The information was described as similar to that found on an employee business card.

Platform action follows publication of the dataset

DDoSecrets, a nonprofit that publishes leaked datasets it considers to be in the public interest, made the material available online. Bluesky did not comment outside U.S. West Coast business hours, but a spokesperson told Wired that the exposed information breached its community guidelines. Rather than removing posts, the platform chose to block the destination link.

Emma Best, DDoSecrets co-founder and journalist, said the dataset did not contain home addresses or personal contact information. Best argued that professional government contact details have particular public-interest value because such information is needed when members of the public pursue records through Freedom of Information Act processes.

DHS takedown effort reaches a searchable copy

Homeland Security said it was aware of a potential breach and was working to address the situation. A separate website hosting a searchable version of the data was subsequently taken offline. Its domain record showed a “serverHold” status, which generally indicates that a registrar has locked or closed a domain.

Homeland Security filed a takedown notice through ZeroFox, a security vendor authorised to act for the department until 2028 in seeking removals of data from the internet. The notice asked the domain registrar to stop serving personal contact and location data relating to people who had not consented to publication.

CentralNic, which hosts the domain name, did not comment on the takedown or whether it had acted on a government demand. ZeroFox also did not comment. Journalist maia arson crimew made a locally hosted version of the dataset available, allowing access on an individual computer rather than through the affected search site.

What organisations should take from the case

The episode illustrates how a breach can quickly create parallel decisions for affected institutions, registrars, platforms and publishers. Organisations responsible for sensitive employee records need incident-response procedures that address technical containment, accurate notices, third-party removal requests and the limits of information already distributed. They also need to distinguish professional data, personal data and the operational policies that govern each response.