Bluesky Blocks Leaked DHS Data Links as Agency Seeks Takedowns

Bluesky is blocking links to a nonprofit's website hosting leaked data on more than 40,000 U.S. Department of Homeland Security user account records, marking them as "malicious" within hours of the breach becoming public.

Users reported the blocks on links to transparency collective DDoSecrets soon after TechCrunch and other outlets reported that Homeland Security had been hacked. A Bluesky spokesperson told Wired the exposed data violates its community guidelines, but the company chose to block the links rather than remove the posts entirely. Bluesky did not respond to TechCrunch's request for comment made outside U.S. West Coast business hours.

What did the hack actually expose?

TechCrunch reported Wednesday that a hacker obtained over 40,000 user account records from Homeland Security's login system. The records include names and contact information — work-issued phone numbers and email addresses — of employees and agents across the department's agencies, including Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE).

The data resembles what you'd find on an employee's business card. DDoSecrets, which publishes leaked datasets in the public interest, made the hacked data publicly available on its site. Researchers investigating alleged abuses by the Trump administration say the data will be invaluable for seeking records from the government under public records laws.

A Homeland Security spokesperson told TechCrunch on Wednesday that the department was "aware of a potential breach and is actively working to address the situation swiftly and effectively."

Did Bluesky get its policy right?

DDoSecrets co-founder and journalist Emma Best disputes the platform's rationale. She told TechCrunch that while Bluesky's terms of service prohibit sharing home addresses and personal contact information, neither appears in the leaked dataset.

"The data contains professional contact information for government employees at a time when the public interest in that exact information has never been higher," Best said. "By requiring the public to provide it for [Freedom of Information Act] requests, the government has made that exact information a crucial piece of the transparency channels they want the public to engage in."

The distinction matters for platform policy. Blocking links suppresses access while leaving posts up — a middle path that sidesteps full takedowns but still cuts off the primary distribution channel for the dataset on Bluesky.

How is Homeland Security fighting back?

The department isn't relying on platform policy alone. Best told TechCrunch that a website hosting a searchable copy of the stolen data was taken down by its domain registrar, knocking it offline.

The search site, built by journalist maia arson crimew, stopped loading as of Thursday morning. An internet record associated with the domain shows it has been placed on "serverHold," a status that generally means the registrar locked or closed the domain.

Homeland Security filed the takedown notice through a security vendor called ZeroFox, which holds authority to act on the department's behalf until 2028 to seek removal of data from the internet. TechCrunch has seen a copy of the notice for the search site, which asks the domain registrar to "stop serving the personal contact and location data of individuals who did not consent to its publication."

CentralNic, which hosts the domain name, did not respond to TechCrunch's request for comment about the takedown or whether it acted on a government demand. ZeroFox also did not respond. The Homeland Security spokesperson did not answer a follow-up question about the takedown notice affecting crimew's website.

Is the data still reachable?

Partly. Crimew also built a locally hosted version of the dataset, letting anyone download and search it on their own computer — a copy that domain-level takedowns can't touch.

The episode sets up a wider test. A federal agency with delegated takedown authority through 2028, a platform blocking links under community guidelines, and a transparency collective arguing the data is public-interest material under FOIA all now point at the same 40,000 records. How Bluesky and other platforms treat the remaining copies will shape how far leaked government data travels.