DOGE days Largest data breach in US history: Three more lawsuits try to stop DOGE DOGE and Musk face three more lawsuits over "brazen ransacking" of private data. Jon Brodkin Feb 12, 2025 4:31 pm | 153 People hold signs at a Save the Civil Service rally hosted by the American Federation of Government Employees outside the US Capitol on February 11, 2025 in Washington, DC. Credit: Getty Images | Kent Nishimura People hold signs at a Save the Civil Service rally hosted by the American Federation of Government Employees outside the US Capitol on February 11, 2025 in Washington, DC. Credit: Getty Images | Kent Nishimura Story textSizeSmallStandardLargeWidth *StandardWideLinksStandardOrange* Subscribers only Learn moreThe US DOGE Service's access to the private data of ordinary Americans and federal employees is being challenged in several lawsuits filed this week.Three new complaints seek court orders that would stop the data access and require the deletion of unlawfully accessed data. Two of the complaints also seek financial damages for individuals whose data was accessed.The US DOGE Service, Elon Musk, the US Office of Personnel Management (OPM), and OPM Acting Director Charles Ezell were named as defendants in one suit filed yesterday in US District Court for the Southern District of New York."The Privacy Act [of 1974] makes it unlawful for OPM Defendants to hand over access to OPM's millions of personnel records to DOGE Defendants, who lack a lawful and legitimate need for such access," the lawsuit said. "No exception to the Privacy Act covers DOGE Defendants' access to records held by OPM. OPM Defendants' action granting DOGE Defendants full, continuing, and ongoing access to OPM's systems and files for an unspecified period means that tens of millions of federal-government employees, retirees, contractors, job applicants, and impacted family members and other third parties have no assurance that their information will receive the protection that federal law affords."The lawsuit names Musk as a defendant "in his capacity as director of the US Doge Temporary Service," which was created by President Trump and has a mandate lasting until July 4, 2026. The temporary organization is separate from the US DOGE Service, which used to be called the US Digital Service. DOGE, of course, is a reference to the popular meme involving a Shiba Inu and in the government context stands for the Department of Government Efficiency.Plaintiffs in the lawsuit include the American Federation of Government Employees, AFL-CIO; the Association of Administrative Law Judges; and individuals who are current or former government workers. The legal team representing the plaintiffs includes lawyers from the Electronic Frontier Foundation (EFF), the State Democracy Defenders Fund, and two law firms.Data access for Musk and a cadre of loyalistsAnother lawsuit filed Monday in US District Court for the District of Maryland said that DOGE gained access to records of both government employees and people outside of government:For example, Defendants Treasury Department and Secretary of the Treasury [Scott] Bessent have improperly disclosed to DOGE representatives the contents of the Federal Disbursement System, which is the government's mechanism for sending payments it owes to individual Americans (as well as other payees). That system contains records relating to every American who receives (among other things) a tax refund, social security benefit, veterans pay, or a federal salary. To facilitate these payments, the system maintains highly sensitive information about millions of Americans, including Social Security numbers, date of birth, bank account information, and home addresses.The lawsuit in Maryland was filed by the American Federation of Teachers, the International Association of Machinists and Aerospace Workers, the National Active and Retired Federal Employees Association, the National Federation of Federal Employees, and six individuals. In addition to the Treasury Department and Bessent, defendants include OPM, Ezell, the Department of Education, and Acting Secretary of Education Denise Carter."Defendants are permitting Elon Musk and a cadre of loyalists imported from his private companies to help themselves to the personal information of millions of Americans, in violation of [the Privacy Act's] legal requirements," the lawsuit said.Yet another lawsuit was filed Monday in federal court in the Eastern District of Virginia by the Electronic Privacy Information Center (EPIC) and one unnamed resident of the district ("Doe 1") who is a federal government employee. The EPIC lawsuit's defendants include OPM, Ezell, the US Treasury Department, Bessent, the US DOGE Service, and the US Doge Service Temporary Organization."This action arises from the largest and most consequential data breach in US history, currently ongoing at the US Department of the Treasury and US Office of Personnel Management. This unprecedented breach of privacy and security implicates the personal information of tens of millions of people, including nearly all federal employees and millions of members of the American public," the lawsuit said, alleging that defendants "have allowed the unlawful misuse of critical data systems housed in OPM and the Treasury Department, endangering plaintiffs and millions of other Americans."This includes tax return information, the lawsuit said. In late January, a longtime Treasury Department official announced his retirement shortly after a clash with DOGE over access to the Fiscal Service payment system that collects and disburses trillions of dollars.The EPIC lawsuit described this incident and alleged that "basic security failures have resulted in the unlawful disclosure of personal dataincluding Social Security numbers and tax informationbelonging to tens of millions of individuals stored in Bureau of Fiscal Service systems and the unlawful disclosure of personal data belonging to millions of federal employees stored in Enterprise Human Resources Integration."Musk may or may not be acting US DOGE administratorThe EFF and EPIC lawsuits both list the "Acting US DOGE Administrator" as a defendant, indicating that it is not clear who holds this position. But the EPIC lawsuit says that Musk "is either the Acting USDS Administrator or otherwise exercising substantial authority within USDS."We sent inquiries about the lawsuits to DOGE, the White House, OPM, Treasury Department, Education Department, and Department of Justice. OPM and the Education Department declined to comment. We will update this article if we get any comments about the lawsuits.This week's lawsuits add to the mounting litigation over DOGE and Musk's access to government records. Last week, a federal judge approved an order that temporarily blocks DOGE access to Treasury payment systems and records until there's a ruling on a motion for a preliminary injunction. The Department of Education was also sued Friday by a California student association over DOGE's access to student financial aid and loan data.EFF: Brazen ransacking of Americans dataThe EFF said on its website that the "brazen ransacking of Americans' sensitive data is unheard of in scale. With our co-counsel Lex Lumina, State Democracy Defenders Fund, and the Chandra Law Firm, we represent current and former federal employees whose privacy has been violated. We are asking the court for a temporary restraining order to immediately cease this dangerous and illegal intrusion. This massive trove of information includes private demographic data and work histories of essentially all current and former federal employees and contractors as well as federal job applicants."The EFF said the OPM database is one of the largest collections of employee data in the US, given that the federal government is the nation's largest employer."In addition to personally identifiable information such as names, Social Security numbers, and demographics, it includes work experience, union activities, salaries, performance, and demotions; health information like life insurance and health benefits; financial information like death benefit designations and savings programs; and classified information [in] nondisclosure agreements. It holds records for millions of federal workers and millions more Americans who have applied for federal jobs," the EFF said.The EFF said "DOGE's unchecked access puts the safety of all federal employees at risk of everything from privacy violations to political pressure to blackmail to targeted attacks," adding that Musk last year "publicly disclosed the names of specific government employees whose jobs he claimed he would cut before he had access to the system."A Washington Post report last week said that some federal "officials have raised concerns that DOGE associates appeared to violate security protocols by using private email addresses or not disclosing their identities on government calls."The individual plaintiffs in the EFF's lawsuit include federal employee Vanessa Barrow, a New York resident who works at the Brooklyn Veterans Affairs Medical Center. "As a federal employee since September 2008, Ms. Barrow's sensitive personal and employment information was included in the OPM records that Defendants disclosed and continue to disclose," the lawsuit said.Seeking financial damagesThe lawsuit has two other named plaintiffs who are former federal employees, and 100 Doe plaintiffs who are current and former employees or contractors of the US government. Plaintiffs, including members of the unions that are part of the lawsuit, are entitled to financial payments because they "have sustained and will continue to sustain actual damages and pecuniary losses directly traceable to Defendants' violations," the lawsuit said.The separate lawsuit filed by EPIC in Virginia said that case's single Doe plaintiff is entitled to statutory damages of $1,000 per each act of unauthorized inspection and disclosure, and punitive damages "because the Treasury Department and DOGE's unlawful disclosure of their confidential return information was either willful or a result of gross negligence.""Taxpayers have a private right of action to seek damages under 26 U.S.C. 7431 for the knowing or negligent unauthorized inspection or disclosure of returns or return information in violation of 26 U.S.C. 6103," the lawsuit said.The lawsuit filed in the District of Maryland by unions and several individuals said the "plaintiffs include veterans who receive benefit payments as provided by law, current and former federal employees whose confidential employment files reside in the Office of Personnel Management's system, and teachers, first responders, and health care workers whose pathway to careers in public service included relying on student loans to fund their own educations."All of these plaintiffs had personal data "improperly disclosed to DOGE representatives in a manner completely divorced from the legitimate purposes for which it was maintained and in violation of their privacy rights," the lawsuit said. The plaintiffs are said to be "concerned that the breach may well result in serious personal, social, and economic harm, from being targeted for harassment and threats to doxxing, swatting, and identity theft."Military veterans worried about data accessPlaintiff Donald Martinez of Colorado served in Iraq for the Army and now receives Social Security disability insurance and other government benefits. "Especially because of his previous military service in a geographically sensitive area and involvement in high-level negotiations because of which he received death threats from terrorists, Plaintiff Martinez is worried that unauthorized access and disclosure of his personal information held within the federal government will compromise his personal safety and security," the lawsuit said.Plaintiff Christopher Purdy of Georgia served in the Army National Guard and was deployed to Iraq and currently leads a nonprofit advocacy group. Purdy is "very worried that Musk and DOGE may use their unauthorized access to his personal information to stop his VA disability payments, a major source of income in his household," the lawsuit said.The Trump executive order establishing DOGE said its goal was "modernizing federal technology and software to maximize efficiency and productivity." It said that US agencies must give DOGE "full and prompt access to all unclassified agency records, software systems, and IT systems."An incident this week may add to concerns about Musk's understanding of government systems. On Monday, he criticized a user on X for stating that the US government uses SQL."This retard thinks the government uses SQL," Musk wrote. The federal government is in fact a heavy user of SQL in multiple forms, including Microsoft SQL server and MySQL Enterprise Edition for Governments.Musk's comment came in a discussion of another post in which Musk claimed without evidence that a lack of de-duplication in the Social Security database "enables MASSIVE FRAUD!!" because "you can have the same SSN many times over." The comment that earned Musk's rebuke was, "TIL Elon has never used SQL."Jon BrodkinSenior IT ReporterJon BrodkinSenior IT Reporter Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry. 153 Comments