United States: The DOGE exfiltrated sensitive data from the agency in charge of labor law

Daniel J. Berulis, a cybersecurity engineer at the National Labor Relations Board (NLRB), warned the U.S. Senate on April 14, 2025, that employees of the DOGE had exfiltrated a large volume of data from the agency’s information systems. The NLRB is the federal agency responsible for ensuring compliance with labor union rights in the United States. As such, it frequently comes into conflict with tech giants. Amazon and SpaceX, claiming its practices are unconstitutional, have sued the agency.

The Department of Government Efficiency (DOGE) is a governmental structure tasked with reducing public spending. It was established in January 2025 by President Donald Trump and is headed by Elon Musk. According to Daniel J. Berulis, DOGE employees were granted, on March 3, 2025, the authority to create “tenant administrator” accounts for the NLRB’s IT systems. This allowed them to access all of the agency’s servers and data, without any logging of their activities.

Berulis identified that these accounts had exfiltrated at least 10 GB of information, “potentially sensitive data ranging from confidential details about employees seeking to form unions to proprietary commercial information.” Neither he nor his colleagues had the necessary privileges to determine exactly which files had been transferred or where they had been sent.

Berulis also revealed several attempted logins to the NLRB’s systems from a Russian IP address using the credentials of a DOGE employee. Fortunately, the agency’s IT system blocked these intrusion attempts. In March 2025, the DOGE also fired three of the five NLRB administrators, effectively paralyzing the agency, as it no longer had the quorum of leaders required to operate.