US DOGE Staffer Sent Unencrypted Treasury Data over Email

A staffer from the Department of Government Efficiency violated Department of Treasury policies by sending an unencrypted database containing personally identifiable information to two senior Trump administration officials, according to new court filings.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

David Ambrose, acting chief information security officer at the Bureau of the Fiscal Service, BFS, and a 19-year career civil servant, filed sworn testimony Friday in a case brought by state attorneys general against DOGE, created to deliver President Trump and supporter Elon Musk’s promise to radically shrink the federal government. Ambrose testified that DOGE staffer Marko Elez sent an unencrypted database without agency approval to two General Services Administration, GSA, officials, before resigning amid backlash over controversial social media posts, including one on X that read: “I was racist before it was cool.” Bloomberg reported in February the Trump administration reinstated Elez to a position at the Social Security Administration.

The suit is one of a number of lawsuits alleging that DOGE disregards data protection policies in its accelerated push to shrink the federal workforce. Ambrose’s declaration reinforces concerns over DOGE-affiliated staffers having access to sensitive government data despite apparent gaps in their understanding of security policies and federal directives designed to protect some of the nation’s most sensitive information.

Ambrose testified that the spreadsheet Elez sent to GSA officials contained “low-risk,” personally identifiable information, limited to names and transactions without Social Security numbers or birth dates. A former federal cybersecurity official told Information Security Media Group the incident reflects either a disregard for government data security policies or a “serious lack of understanding” about federal information handling protocols and the potential risks of mishandling sensitive data.

“Either way, you’re looking at a really dangerous situation,” the former official said.

Court filings show that Elez made no alterations to bureau payment systems or data entries. He briefly obtained “read-write” access to the systems, access that was later downgraded to read-only without evidence he was informed of the change.

Ambrose testified that Elez’s distribution of the spreadsheet violated BFS policies since the database was not encrypted and he failed to obtain prior approval through a Form 7005, which requires disclosing the data being sent and the security measures to be followed.

U.S. District Court for the District of Southern New York Judge Paul Engelmayer previously determined in the ongoing case that DOGE’s access to BFS systems left the Treasury Department division tasked with disbursing trillions of dollars annually “more vulnerable to hacking.” Engelmayer issued a temporary restraining order directing all special government employees to “immediately destroy any and all copies of material downloaded from the Treasury Department’s records and systems” as the case continues.

The Treasury Department, DOGE and the White House did not respond to multiple requests for comment.