Social Security Administration Vendor Cyber Rating & Cyber Score

Description: Former SSA Chief Data Officer Warns of Massive Social Security Data Breach A whistleblower has raised alarms over a potential national security disaster involving the exposure of sensitive Social Security data for every American with or who ever had a Social Security number (SSN). Chuck Borges, the former chief data officer of the Social Security Administration (SSA), resigned in August and filed a complaint alleging that employees of the Department of Government Efficiency (DOGE) uploaded a copy of the SSA’s entire database to an unsecured cloud environment. The breach, if confirmed, could expose names, SSNs, and addresses critical personal data vulnerable to fraud and identity theft. Borges described the incident as a "national-security disaster" with lifelong consequences for affected individuals, urging congressional investigation. The SSA has not publicly confirmed the breach, but the allegations highlight systemic risks in government data handling. The incident underscores growing concerns over cybersecurity lapses in federal agencies and their potential long-term impact on millions of Americans.

Description: Senate Democrats, led by Senator Gary Peters, have raised alarms over the Social Security Administration (SSA) failing to secure federal data despite clear warnings. An internal SSA risk assessment revealed up to a 65% chance of a catastrophic breach, yet critical systems remain operational without verified security controls. The exposed vulnerabilities threaten sensitive federal data, including personally identifiable information (PII) of millions of Americans such as Social Security numbers, financial records, and employment histories.The lack of mitigating measures heightens the risk of large-scale data exfiltration by cybercriminals or state-sponsored actors, potentially leading to identity theft, financial fraud, or systemic disruptions in federal services. Given the SSA’s role in administering benefits to retirees, disabled individuals, and survivors, a successful breach could erode public trust, trigger legal repercussions, and impose massive remediation costs. The scenario aligns with long-standing concerns about legacy IT infrastructure in government agencies, where outdated systems and delayed patches create exploitable gaps. Without immediate intervention, the SSA’s negligence could culminate in a devastating cyber incident with cascading effects on national security and citizen welfare.

Description: Former DOGE Engineer Accused of Stealing Sensitive U.S. Citizen Data from Social Security Administration A whistleblower complaint, reported by *The Washington Post*, alleges that a former software engineer from Elon Musk’s Department of Government Efficiency (DOGE) stole highly sensitive personal data from the U.S. Social Security Administration (SSA) and stored it on a thumb drive. The ex-employee, who worked at the SSA last year before joining a government contractor in October, reportedly told colleagues he possessed two restricted databases Numident and the Master Death File containing records on over 500 million living and deceased Americans. The data allegedly includes Social Security numbers, birth details, citizenship status, race, ethnicity, and parental information. The whistleblower also claimed the former DOGE engineer had "God-level" access to SSA systems, raising concerns about unauthorized data extraction. While the SSA’s inspector general is investigating the complaint, an SSA spokesperson denied the allegations, calling the report "fake news" and accusing *The Washington Post* of sensationalism. The inspector general’s office has not yet commented. This incident is the latest in a series of controversies surrounding DOGE’s involvement with the SSA. In January, two DOGE members were accused of accessing and sharing restricted Social Security numbers to assist an advocacy group allegedly seeking to overturn election results. Last year, another whistleblower warned that DOGE uploaded hundreds of millions of SSA records to an insecure cloud server, and a federal judge blocked DOGE from accessing SSA systems, citing an unauthorized "fishing expedition" for fraud. Since the Trump administration installed DOGE members at the SSA last year, at least a dozen technical staff and engineers have worked at the agency, though their roles and activities were reportedly not disclosed to other SSA employees. The ongoing investigations highlight persistent concerns over data security and oversight within the agency.

Description: Former SSA Chief Data Officer Alleges Massive Social Security Data Breach, Calls for Congressional Investigation A whistleblower has raised alarm over what he describes as a "national-security disaster" involving the exposure of sensitive Social Security Administration (SSA) data. Chuck Borges, who served as the SSA’s chief data officer until his resignation in August, alleges that employees of the Department of Government Efficiency (DOGE) uploaded a copy of the SSA’s entire database containing names, Social Security numbers, and addresses of every American with a Social Security number to an unsecured cloud environment. Borges, who filed a formal complaint, claims the breach stems from government mismanagement and could leave millions vulnerable to fraud for decades. The incident, if confirmed, would represent one of the most severe data exposures in U.S. history, affecting current and former Social Security number holders. The whistleblower has called for a congressional investigation, warning that the fallout could have lifelong consequences for affected individuals. The SSA has not publicly confirmed the breach, and details about the timeline, scope, and potential misuse of the data remain unclear. The allegations highlight growing concerns over federal data security practices and the risks of improper cloud storage oversight.

Description: DOGE Employees Under Scrutiny for Alleged Election Interference and Data Misuse The U.S. Department of Justice (DOJ) has revealed in a court filing that members of Elon Musk’s "DOGE" team at the Social Security Administration (SSA) engaged in undisclosed communications with an unnamed advocacy group aiming to overturn election results in certain states. The interactions allegedly included a signed agreement that may have involved matching Social Security data with state voter rolls a potential violation of federal privacy laws. The DOGE employees have been referred for possible Hatch Act violations, which bars government officials from using their positions for political activities. According to DOJ officials, the advocacy group approached the SSA team with a request to analyze voter rolls for evidence of fraud, though the exact states targeted remain unspecified. Further concerns arose over the unauthorized use of third-party servers, including Cloudflare, to handle sensitive data contrary to a court ruling restricting access to such information. A senior adviser to Musk and the DOGE team, Steve Davis, was reportedly copied on a March 3, 2025, email containing a password-protected file with the private data of approximately 1,000 individuals from SSA systems. It remains unclear whether the data was accessed or exploited. The DOJ stated that no evidence suggests broader SSA awareness of the communications or the "Voter Data Agreement" beyond the involved DOGE members. The investigation is ongoing, with no further details on potential legal consequences or the advocacy group’s identity.

Description: Whistleblower Exposes Major Social Security Administration Data Breach A whistleblower has revealed a significant data breach at the U.S. Social Security Administration (SSA), alleging that a former employee copied sensitive records onto a personal thumb drive. The complaint states the individual had full system access, raising concerns about the potential exposure of millions of confidential records. The incident highlights vulnerabilities in internal access controls and the risks posed by insider threats. While the exact scope of the breach remains unclear, the allegations underscore the need for stricter safeguards around highly sensitive government data. The SSA has not yet publicly confirmed the breach or its impact.