DOGE Uploaded Social Security Data to Cloud

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, Department of Government Efficiency staff inside the U.S. Social Security Administration shared sensitive data through an unauthorized Cloudflare server. The Canadian Investment Regulatory Organization said a phishing breach affected 750,000 investors. The U.K. National Cyber Security Center warned of rising Russia-aligned hacktivist DDoS attacks. Ingram Micro disclosed a ransomware breach exposing employee records. CVE disclosures surged 21% in 2025. South Korea’s SK Telecom challenged a record leak fine. Researchers disclosed critical Chainlit flaws and warned that North Korean hackers are abusing Microsoft VS Code workflows.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Members of mercurial centibillionaire Elon Musk’s Department of Government Efficiency copied Social Security data onto a cloud server, bypassing federal cybersecurity policy, U.S. federal prosecutors acknowledged in a Friday court declaration.

The admission tracks with an August 2025 whistleblower report accusing DOGE of creating a replica of Social Security data in a cloud system lying outside of federal oversight (see: Whistleblower: DOGE Made Live Copy of Social Security Data).

The Social Security Administration has been unable to determine if the data is still on the third-party cloud provider, which prosecutors identify as Cloudflare. It determined that between March 7, 2025, until March 17, 2025, DOGE employees “were using links to share data through the third-party server.”

The disclosure is one in a litany of about-faces the federal government is making in ongoing litigation launched by federal unions over DOGE activities at the Social Security Administration. Musk, empowered by President Donald Trump, in the first half of 2025 led a youthful brigade of would-be cost cutters in an initiative that critics later concluded wasted at least $21.7 billion.

The court filing, a “notice of corrections to the record,” also disclosed that a DOGE employee signed an agreement with a political advocacy group looking for evidence of voter fraud in a bid to overturn election results. The filing says the agreement could have been an attempt to match voter roll data against the Social Security data, although the federal agency told prosecutors that it has “not yet seen evidence that SSA data was shared with the advocacy group.”

The Social Security Administration said it referred two DOGE employees to the U.S. Office of Special Counsel for likely violations of the Hatch Act, a 1939 law that prohibits partisan activity by federal employees.

The filing also described a March 3, 2025, email in which a DOGE team member sent the Department of Homeland Security and a DOGE advisor at the Department of Labor an encrypted, password-protected file that SSA believes contained names and addresses of roughly 1,000 people. Agency officials have been unable to open the file to confirm its contents.

Prosecutors additionally admitted that a DOGE team member continued to access the “Numident” database containing applications for Social Security cards and dates of death even after a federal judge entered a temporary restraining order revoking DOGE’s access.

The Canadian Investment Regulatory Organization is warning investors that a phishing-based cyberattack exposed sensitive information linked to about 750,000 Canadian investors.

The incident, first disclosed in August 2025, involved unauthorized access to data. CIRO at the time said critical functions were available and its real-time equity market surveillance operations continued normally, with “no active threat” in its systems.

The exposed data may include names, contact details, dates of birth, annual income, Social Insurance numbers, government-issued ID numbers, investment account numbers and account statements. CIRO said it does not collect login credentials such as passwords, PINs or security questions and those were not compromised.

U.K.-based organizations are actively being disrupted by Russian-aligned hacktivist groups, the National Cyber Security Center warned.

The NCSC published Monday an alert highlighting a recent uptick in denial-of-service attacks carried out by self-styled hacktivist groups aligned with the Kremlin. Those targeted include governmental bodies, local authorities and national infrastructure operators.

The advisory mentioned hacktivist group NoName057(16) – active since at least March 2022 – as having conducted several persistent attacks against NATO member states.

The cybersecurity agency said organizations should harden defenses and institute mitigation measures through traffic filtering, installing web application firewalls, incident response planning and enacting rate-limiting policies.

Information technology distributor Ingram Micro is notifying individuals of a July 2025 ransomware attack and subsequent breach affecting roughly 42,000.

In a breach notification letter Ingram Micro said attackers stole documents including an array of personal information. According to the company, stolen data includes names, birthdates, Social Security numbers, passport numbers, driver’s license numbers and employment-related data.

Following the attack on July 3, 2025, Ingram took critical systems offline in an effort to contain the breach, resulting in widespread service outages for customers. It restored affected systems and operations by July 9.

The company calculates that 42,521 people were affected by the breach. Ransomware gang SafePay – first observed in September 2024 – listed Ingram on its leak site in July, claiming to have exfiltrated 3.5 terabytes of data. The group later published the stolen data, suggesting Ingram refused to meet ransom demands.

Ingram Micro employs more than 23,000 and serves more than 161,000 customers worldwide, reporting $48 billion in net sales in 2024.

Vulnerability disclosures rose again in 2025, pushing annual CVE volume to 48,185 published entries, a 20.6% increase year over year, found analysis by Jerry Gamblin, a Cisco threat detection and response principal engineer.

Known vulnerabilities encompassed 3,984 critical and 15,003 high-severity vulnerabilities, with an average CVSS score of 6.60.

Disclosure volume also clustered heavily across the year. December alone accounted for 5,500 CVEs, more than 11% of the annual total. The single busiest day was Feb. 26, when 793 CVEs were published. CVE publication also followed predictable release cycles, with Tuesdays accounting for 11,754 CVEs in 2025, while weekdays averaged 8,918 CVEs, compared with 1,796 on weekends.

But the bigger problem for defenders is speed. VulnCheck tracked 159 CVEs with first-time public evidence of in-the-wild exploitation in the first three months of 2025, and found 28.3% were exploited within one day of disclosure. It also reported 25.8% of those exploited vulnerabilities were still awaiting analysis in the National Vulnerability Database, limiting the value of scoring and metadata during the window when response time matters most.

South Korea’s SK Telecom has challenged a 135 billion won – $91 million – penalty imposed by the country’s privacy watchdog after a data breach hit all 23 million of its mobile subscribers, Yonhap News Agency reported Monday.

Regulators fined the telecom after it disclosed a major leak of universal subscriber identity module data months after it occurred. The delayed admission triggered a wider probe and prompted the operator to offer free USIM replacements to every customer.

The fine is the largest ever issued by the South Korean data protection authority since it was established in 2020, topping the combined 100 billion won sanction the regulator levied against tech giants Google and Meta in 2022.

In October 2025, security researchers reported a ransomware group calling itself CoinbaseCartel claimed to have infiltrated SK Telecom’s networks through a compromised Bitbucket account, stealing 19.6 megabytes of source code, project files, Dockerfiles and AWS keys.

Security researchers at Zafran Labs have disclosed two critical vulnerabilities in open-source artificial intelligence framework Chainlit, warning they can expose sensitive data and enable cloud account takeover.

The flaws, dubbed ChainLeak and tracked as CVE-2026-22218 and CVE-2026-22219, affect internet-facing Chainlit deployments and can be triggered without user interaction, the researchers said. Chainlit released a patch.

Chainlit is widely used by developers to quickly spin up production-style AI chat applications and is embedded into common large language model stacks, often sitting in front of workflows that handle prompts, conversation history and API credentials.

CVE-2026-22218 is an arbitrary file read vulnerability tied to how Chainlit processes “elements” attached to chat messages. By abusing the /project/element endpoint and manipulating element parameters, an attacker can influence the file path Chainlit reads and copies into the attacker’s session. That enables the retrieval of files accessible to the Chainlit server, including application data and potentially credentials, depending on the environment.

The risk escalates in multi-tenant setups. Researchers warned that when Chainlit is used with LangChain caching enabled, prompts and responses may be stored locally in a SQLite database .chainlit/.langchain.db. If exposed through the file read issue, this can result in cross-tenant leakage of user prompts and outputs over time.

CVE-2026-22219 is a server-side request forgery flaw in Chainlit’s SQLAlchemy integration. It can be triggered using a crafted URL that forces the server to initiate outbound requests to internal resources, creating a path to probe private networks and cloud metadata services.

Zafran said the vulnerabilities reflects a broader problem: traditional web flaws are increasingly being embedded into AI application infrastructure, turning fast-moving AI deployments into high-impact attack surfaces.

Threat actors linked to North Korea are expanding their abuse of Microsoft Visual Studio Code to execute malware through seemingly legitimate developer workflows, finds research from Jamf Threat Labs.

The activity builds on the “Contagious Interview” campaign, which lures targets with fake job recruiters and asks them to clone and open malicious Git repositories as part of a supposed technical assignment. Contagious Interview has also been linked to the delivery of a macOS remote access Trojan called EtherRAT, signaling a shift from credential theft to persistent endpoint compromise (see: North Korean Hackers Hit React2Shell Targets).

Jamf said when a victim opens the project in Visual Studio Code and trusts the repository, the editor can automatically process a tasks.json configuration file that may contain attacker-controlled commands. It observed attackers using this mechanism on macOS to run background shell commands that fetch a remote JavaScript payload and pipe it directly into the node.js runtime. The payload establishes persistence, fingerprints the host and polls a command-and-control server for instructions, enabling remote code execution.

Researchers also flagged infrastructure hosted on vercel.app, reflecting a broader shift by the operators toward developer-friendly hosting platforms.

Other Stories From This Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey.