Bluesky Blocks Links to Leaked DHS Employee Data Amid Government Takedown Efforts

Social network Bluesky has begun blocking user links to a transparency collective's website that hosted leaked personnel data from the U.S. Department of Homeland Security (DHS). According to reports, the breach involves over 40,000 user account records from a DHS login system, including professional contact details like work phone numbers and email addresses for employees across agencies such as Customs and Border Protection and Immigration and Customs Enforcement.

Platform Response and Policy

Users trying to share links to the nonprofit transparency collective DDoSecrets found the URLs flagged as "malicious." Bluesky Chief Operating Officer Rose Wang explained the platform's decision in statements to media:

• Safety and Privacy: Wang stated that community guidelines prohibit the unauthorized sharing of personal information that could pose safety risks.
• Link Blocking vs. Deletion: The platform chose to block links rather than delete individual posts to avoid limiting broader reporting, commentary, and public discussion.
• Wording Updates: Wang acknowledged via a social media post that the platform plans to update the warning message text.

Takedown Efforts and Impact

Following the leak, a searchable database site named Icepick, created by journalist maia arson crimew, went offline after being placed on "serverHold" by its domain registrar. Reports indicate that DHS filed a takedown notice through security vendor ZeroFox, requesting the removal of unauthorized personal contact and location data.

• Data Contents: DDoSecrets co-founder Emma Best stated that the leaked dataset contains professional, rather than personal or home, contact information useful for public records requests.
• Alternative Access: A locally hosted version of the data was also made available by crimew for personal computer access.
• Pending Responses: Domain registrar CentralNic, ZeroFox, and DHS representatives did not immediately respond to requests for comment regarding the takedown notices.

Readers can verify original announcements by reviewing statements directly from transparency groups, platform operators, and official cybersecurity reporting channels.