Bluesky Blocks Links to Leaked DHS Staff Data as Takedowns Begin
Bluesky is blocking its users from reaching the website of DDoSecrets, the nonprofit transparency collective that made leaked U.S. Department of Homeland Security personnel data publicly available. The platform has marked links to the site as "malicious," after reports that Homeland Security had been hacked. TechCrunch
The breach involves DHS's login system. A hacker obtained more than 40,000 user account records, including names, work-issued phone numbers and email addresses of employees and agents of U.S. Customs and Border Protection (CBP) and U.S. Immigration and Customs Enforcement (ICE). Wired reported on October 28 that the exposure, which it put at 41,000 workers, includes undercover ICE agents. Wired Reuters reported the same day that a leak website had released data on tens of thousands of DHS employees. Reuters TechCrunch reporter Zack Whittaker had reported on October 28 that a hacker stole personnel data about thousands of Homeland Security employees. TechCrunch
DDoSecrets co-founder Emma Best has described the dataset as professional contact information for government employees. In her account, it does not include home addresses or personal contact information. The department's position is narrower. A DHS spokesperson said the department was aware of a potential breach and was working to address the situation.
The enforcement picture moved on several fronts. A searchable copy of the data, hosted at icepi.cx and built by journalist maia arson crimew, no longer loads. Its domain has been placed on serverHold by the registrar, a status that tells the registration company to stop the domain from resolving. Homeland Security also filed a takedown notice through the security vendor ZeroFox, which holds authority to act on the department's behalf until 2028. The notice asks the registrar to stop serving personal contact and location data published without consent. That request targets the infrastructure layer, the systems that make a domain reachable, rather than the platforms where the links circulate.
Bluesky's response is a different kind of action. The company told Wired that the exposed DHS data violates its community guidelines. It chose to block the link instead of removing the posts that carried it. Blocking a domain at the link layer restricts access to the entire site, including material unrelated to the DHS data, while leaving the individual posts in place. Removing posts would have targeted the specific content. The company's choice reflects a judgment about scope that is separate from the question of whether the data should be public.
In my view, the case shows how many control points now sit between a leaked dataset and its readers. A platform can restrict links, a registrar can suspend a domain, a security vendor can file a notice under contract, and a collective can host the files elsewhere. Each layer acts on a different object under a different authority, and none of them alone determines whether the records remain reachable. For operators of trust and safety systems, the practical question is which layer should act, and at what granularity.
The broader context here is the data itself. The records describe people who work in sensitive roles, and the dispute over whether the fields are professional or personal is the central factual disagreement. Work-issued phone numbers and email addresses are the kind of identifiers that can be used for phishing and social engineering against staff, which is one reason the takedown requests focus on contact and location fields. Whatever the classification, the department says it is working to address the breach, and the takedown mechanisms now in motion will determine how far the copies travel.
