Bluesky blocks links to DHS employee data leak as authorities seek site takedowns

The leak and the platform's response

After reports of a hack of the US Department of Homeland Security (DHS) the social network Bluesky began blocking links to the website of the nonprofit archive DDoSecrets, which published the stolen data. Users noticed that links were being flagged as 'malicious' shortly after media reports. A Bluesky spokesperson, speaking to Wired, said the exposed data violates the network's community rules, but the platform restricted only the links and did not remove the posts themselves. Bluesky did not respond to TechCrunch's request sent outside business hours on the US West Coast.

What is known about the leak

According to TechCrunch, a hacker obtained more than 40,000 records of accounts from a DHS login system, including names and work contact details — office phone numbers and email addresses — of employees and agents of agencies including Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE). The data is described as similar to the information on an employee's business card. DDoSecrets, which publishes leaks in the public interest, made the dataset publicly available; researchers tracking abuses by the Trump administration call the data valuable for public records requests.

Takedown requests and domain blocking

DDoSecrets co-founder Emma Best told TechCrunch that the site hosting a searchable copy of the stolen data was taken offline by the domain registrar. The search site, created by journalist maia arson crimew, stopped loading on Thursday morning; the domain record shows a 'serverHold' status, which usually means the domain has been blocked by the registrar. DHS sent a takedown request through the security provider ZeroFox, which is authorized to act on behalf of the department until 2028; TechCrunch reviewed a copy of the notice, which demands that the registrar 'stop providing personal contact and geolocation data of individuals who did not consent to publication.' CentralNic, which serves the domain, and ZeroFox did not respond to requests, and a DHS representative did not comment on the takedown targeting the Icepick site. Best, however, asserts that the dataset contains no home addresses or personal contact information prohibited by Bluesky's rules: 'The data contains the professional contacts of public servants at a time when public interest in them has never been higher,' she said. Crimew has also prepared a local version of the data, available on the user's own computer.