The U.S. government acknowledged in court filings that members of the Department of Government Efficiency (DOGE) may have improperly accessed and handled sensitive Social Security Administration (SSA) data — including using an unauthorized third-party server and sharing records outside the agency. The admissions, disclosed in a “Notice of Corrections to the Record” in January 2026, reversed earlier statements and intensified a long-running legal fight over how Americans’ most sensitive personal data has been handled. Here’s a clear, neutral rundown of what was disclosed, where the case stands now, and what it means for your data.
This is a politically charged topic, so this article sticks to what’s documented in court records and official statements from both sides.
What did the government actually acknowledge?
In a court filing, the Department of Justice disclosed that, based on an SSA records review conducted during or after October 2025, the agency’s former DOGE team engaged in “communications, use of data, and other actions” that were “potentially outside of SSA policy and/or noncompliant” with a federal court’s March 2025 order limiting data access.
Several specific concerns were detailed in the filings. DOGE team members reportedly used an unauthorized third-party server (Cloudflare) between roughly March 7 and March 17, 2025, to share SSA data — a system the DOJ said was not approved for storing SSA data. Members also allegedly sent a password-protected file of private records to DOGE affiliates outside the agency, and retained the ability to see data even after a judge had temporarily restricted access. One DOGE team member reportedly signed a “Voter Data Agreement” with an unnamed political advocacy group interested in analyzing state voter rolls — an unusual arrangement for federal employees that led to referrals for potential violations of the Hatch Act, which limits political activity by government workers.
Notably, the SSA stated it still could not determine exactly what data was transmitted, whether it still exists on the external server, or the full scope of the access — an acknowledgment that the agency itself lacks complete visibility into what happened.
How did the case get here? A timeline
The dispute traces back to early 2025. In January 2025, an executive order established DOGE and directed agencies to give its teams broad access to records and IT systems to “maximize governmental efficiency.” That access triggered a wave of lawsuits.
In February 2025, a coalition of labor unions and retiree advocates — including AFSCME and the Alliance for Retired Americans, represented by the group Democracy Forward — sued the SSA, arguing that opening its data systems to DOGE violated the Privacy Act of 1974 and federal rulemaking law. In March 2025, the U.S. District Court for the District of Maryland (Judge Ellen Hollander) issued an order limiting DOGE’s access to non-anonymized data unless team members met conditions like training and background checks.
The government appealed. In June 2025, the U.S. Supreme Court, in a 6-3 emergency-docket decision (SSA v. AFSCME), lifted the lower court’s injunction, allowing DOGE access to the data while the underlying case proceeded. The unsigned majority said the SSA could “proceed to afford members of the SSA DOGE Team access to the agency records in question.” Justices Ketanji Brown Jackson and Sonia Sotomayor dissented, warning the decision created “grave privacy risks for millions of Americans.”
Where does the case stand in 2026?
The legal fight is ongoing. After the January 2026 “Notice of Corrections,” developments moved quickly:
On April 10, 2026, the Fourth Circuit Court of Appeals vacated the earlier preliminary injunction and sent the case back to the district court. The court noted the new revelations were “alarming” but based its decision on the record as it stood when the injunction was originally issued. Then, on April 14, 2026, the district court lifted its stay and granted the plaintiffs’ request for discovery — meaning the challengers can now formally investigate the full scope of DOGE’s data access and the government’s prior statements.
In short: courts have allowed DOGE’s access to continue, but the lawsuit examining whether that access was lawful is now proceeding into a fact-finding phase.
What do both sides say?
This is where the picture splits sharply along the lines you’d expect, and it’s worth presenting fairly.
Supporters of the access, including the White House and SSA leadership, have framed DOGE’s work as a legitimate effort to modernize aging government systems and root out waste and fraud. After the Supreme Court ruling, SSA Commissioner Frank Bisignano called it “a major victory for American taxpayers,” and a White House spokesperson described it as “a huge victory for the rule of law.”
Critics, including the plaintiff coalition and privacy advocates, argue the access violated established legal safeguards and exposed sensitive data. Democracy Forward’s president said the group looked forward to “getting to the bottom of this harmful conduct,” and the dissenting justices warned of privacy risks. The disagreement is genuine and unresolved — which is precisely what the ongoing discovery process is meant to clarify.
Why does this matter for everyday Americans?
Regardless of where you land politically, the case raises broader questions about how government agencies safeguard sensitive data. SSA records include some of the most sensitive information the government holds — Social Security numbers, medical histories, and banking details — protected under the Privacy Act. The use of an unapproved third-party server and the agency’s stated inability to fully account for what data moved where are exactly the kinds of data-governance failures that security professionals warn about, in government and the private sector alike. We cover the broader principles in our guide to cybersecurity and data privacy and the tools organizations use to control sensitive information in our overview of data privacy management software.
It also sits within a wider 2026 conversation about data, technology, and government oversight — from how governments are responding to AI-related harms to the administration’s broader cybersecurity and AI policy, and even private-sector data questions like those raised in the US TikTok ownership deal.
Can you protect your own data?
Unfortunately, individuals have little direct control over how a federal agency stores their records — that’s what laws like the Privacy Act and oversight processes are designed to enforce. But you can take general steps to limit your overall exposure: monitor your credit and Social Security statements for unusual activity, enable strong authentication on financial and government accounts, and be alert to identity-theft warning signs. For your day-to-day online privacy more broadly, our guide on setting up a VPN on Windows is a practical starting point, though it won’t affect government-held records specifically.
The bigger takeaway is that this case is still unfolding. The courts have not made a final ruling on whether the data handling was lawful, and the discovery process may reveal more. It’s a story worth following for anyone who cares about how personal data is protected.
FAQ
1. What did the government admit about DOGE and Social Security data?
In a January 2026 court filing, the Justice Department acknowledged that the SSA’s former DOGE team engaged in actions potentially outside agency policy and noncompliant with a court order — including using an unauthorized Cloudflare server to share SSA data, sending private records to outside affiliates, and retaining access after a judge restricted it. The SSA said it still cannot determine the full scope.
2. Is DOGE allowed to access Social Security data now?
Yes, currently. In June 2025 the Supreme Court lifted a lower-court injunction, allowing DOGE access while litigation continues, and in April 2026 an appeals court vacated the injunction. However, the underlying lawsuit over whether that access is lawful is ongoing and has entered the discovery phase.
3. What law is at the center of the case?
The Privacy Act of 1974, which governs how federal agencies collect, store, and share Americans’ personal information. Plaintiffs argue DOGE’s access violated the Privacy Act and federal rulemaking procedures; the government argues the access was a lawful part of efforts to modernize systems and reduce fraud.
4. Was anyone’s data actually leaked or misused?
It remains unconfirmed. Court filings describe potential improper handling and an inability by the SSA to fully account for what data moved, but officials have said there is no confirmed evidence data was shared outside the agency. The discovery process is intended to establish the facts.
5. How can I protect my Social Security information?
You can’t control how a federal agency stores its records, but you can monitor your credit and Social Security statements for unusual activity, use strong authentication on financial and government accounts, and watch for signs of identity theft. These steps reduce your overall exposure even though they don’t affect government-held data directly.