When Uncontrolled Access Becomes the Threat
In cybersecurity, we focus on external actors — APTs, ransomware, supply chain attacks. We build firewalls, deploy zero-trust, and harden endpoints. The DOGE/SSA case exposes a threat none of that stops: privileged access granted without controls, authorized from the top.
Here is what confirmed evidence shows.
The SSA Numident records every Social Security number ever issued in the United States — since 1936, over 548 million entries — including names, dates and places of birth, citizenship status, race, ethnicity, and parents' names. Combined with the Master Death File, it is effectively a near-complete identity registry of every American who has ever lived or died.
On August 26, 2025, SSA Chief Data Officer Charles Borges filed a whistleblower disclosure with the Office of Special Counsel. He alleged DOGE officials uploaded a live Numident copy — covering 300+ million Americans — to a cloud environment with no audit process, no access tracking, and no security oversight. The sanitized complaint is publicly available. Borges resigned three days later.
The approval chain is documented in the filing. SSA CIO Aram Moghaddassi signed a July 15, 2025 memo formally accepting the risk: "the business need is higher than the security risk." DOGE official Michael Russo approved the transfer with one word: "Approved."
A second whistleblower complaint triggered a formal SSA Inspector General review on March 6, 2026. It alleged a former DOGE engineer left SSA in October 2025 and carried database data on a thumb drive, asking colleagues to "sanitize" it before personal use. The SSA denied these allegations. No exfiltration has been confirmed.
Rep. Robert Garcia, ranking member of the House Oversight Committee, described the situation as "dangerous and outrageous." He warned that without proper access controls and revocation, former DOGE personnel may retain the ability to access and manipulate SSA data and systems.
What does this mean for security professionals?
Access is not neutral. The confirmed facts establish that a live copy of one of the most sensitive U.S. databases was moved outside its security boundary — with no audit trail, no tracking, and explicit executive authorization overriding security concerns.
That is not a technical failure. It is a governance failure — and governance failures are the most dangerous category, precisely because they originate at the level that defines what controls exist in the first place.
For those in identity protection, access management, and data governance: this case is a precise illustration of what happens when "business need" becomes a permanent override on security policy. The controls that failed here were not technical — they were institutional.
The perimeter was not breached. It was opened from the inside.