Bluesky blocks links to leaked DHS employee data as government pushes takedowns

Bluesky has started blocking links to DDoSecrets, the nonprofit transparency collective hosting a recently leaked dataset of U.S. Department of Homeland Security employees, and is labeling those links as "malicious," according to TechCrunch. The blocks appeared shortly after TechCrunch and other outlets reported that Homeland Security had been hacked.

What the leak contains

According to TechCrunch, a hacker obtained more than 40,000 user account records from Homeland Security's login system. The records include names and contact details — work-issued phone numbers and email addresses — of employees and agents across the department's agencies, including Customs and Border Protection and Immigration and Customs Enforcement. TechCrunch characterized the exposed information as roughly what an employee's business card would show.

DDoSecrets, which publishes leaked datasets it considers to be in the public interest, made the data available online. Researchers investigating alleged abuses by the Trump administration told TechCrunch the records will be useful for pursuing government documents under the Freedom of Information Act, since agencies generally require requesters to identify the employees whose records they want.

A Homeland Security spokesperson told TechCrunch the department was aware of a potential breach and was working to respond.

Bluesky's rationale, and a factual dispute

Users noticed DDoSecrets links being flagged as malicious soon after the breach news broke. Bluesky did not respond to TechCrunch's request for comment, but a company spokesperson told Wired that the exposed data violates its community guidelines, and that Bluesky chose to block the link rather than remove the posts pointing to it.

DDoSecrets co-founder Emma Best disputed that interpretation. She told TechCrunch that although Bluesky's terms prohibit sharing home addresses and personal contact information, neither category appears in the leaked dataset. The material, Best argued, is professional contact information for government employees at a moment of unusually high public interest — and the government itself requires the public to supply that kind of information when filing FOIA requests.

Takedown pressure moves to the domain layer

Bluesky's moderation decision coincides with a separate removal effort aimed at the infrastructure hosting the data. Best told TechCrunch that a website serving a searchable copy of the dataset was knocked offline by its domain registrar. A search site built by journalist maia arson crimew stopped loading as of Thursday, and internet records show its domain placed on "serverHold," a status that generally indicates the registrar locked or closed it.

TechCrunch, which says it has seen a copy of the takedown notice, reports that Homeland Security filed it through the security vendor ZeroFox, which holds authority to act on the department's behalf until 2028. The notice asks the registrar to stop distributing individuals' contact and location details, which it says were published without their consent. CentralNic, which hosts the domain name, did not respond to TechCrunch's questions about whether it acted on a government demand, and ZeroFox also declined to comment. Crimew has additionally released a locally hosted version of the dataset that anyone can run on their own computer.

Why it matters

The episode is a case study in how platform moderation and government pressure intersect around leaked data. Bluesky took a middle path — suppressing a URL while leaving posts up — which avoids deleting discussion outright but still makes the underlying journalism harder to reach. Whether that call rests on an accurate reading of the data is contested: Bluesky says its guidelines were violated, while DDoSecrets maintains the dataset contains only professional details.

The registrar-level takedown raises the broader concern. When a federal department can delegate removal authority to a private vendor through 2028, and registrars can effectively erase sites with little public process, transparency projects face chokepoints far upstream of any platform's moderation system — with minimal visibility and no obvious appeal. For a network like Bluesky, which has built its identity around openness and user control, how it handles government-adjacent removal pressure like this will be watched closely.