Bluesky blocks links to leaked list of Homeland Security staff

Bluesky users found that links to a nonprofit's website, which hosts a leaked list of Homeland Security employees, were flagged as "malicious" and blocked. The leak came from a hack of the department's login system. Separately, a site that let people search the data went offline after a government takedown notice. Both moves are drawing criticism.

What happened

TechCrunch reported on Wednesday that a hacker took over 40,000 user account records from Homeland Security's login system. The records include names, work phone numbers and work email addresses of employees and agents at agencies such as Customs and Border Protection and Immigration and Customs Enforcement. The data resembles what is printed on a business card.

The nonprofit DDoSecrets, which publishes leaked data sets in the public interest, made the data public. Soon after, users reported that links to its site were being marked as malicious on Bluesky.

Two sides of the argument

A Bluesky spokesperson told Wired that the exposed data breaks its community guidelines. The company chose to block the link instead of removing the posts that shared it.

DDoSecrets co-founder Emma Best disagrees. Best says Bluesky's rules ban sharing home addresses and personal contact information, and that neither is in this data. Best also says researchers looking into abuses by the Trump administration will find the list valuable for requesting government records under public records laws.

The search site goes dark

A search site built by journalist maia arson crimew no longer loaded as of Thursday morning. An internet record for the domain shows a "serverHold," which generally means the domain registrar locked or closed it. Best says the registrar took the site down.

Homeland Security filed a takedown notice through a security vendor called ZeroFox, which can act for the department until 2028. The notice asks the registrar to stop serving contact and location data of people who did not consent to its publication. Crimew also made a version people can run on their own computer.

What is not known yet

• Whether CentralNic, which hosts the domain name, acted on a government demand. It did not respond.
• Whether Bluesky will say more. It did not answer TechCrunch outside West Coast business hours.
• Homeland Security has not answered questions about the takedown notice.

The department has said it is aware of a potential breach and is working to address it.