DOGE Worker’s Code Supports NLRB Whistleblower
Summary: An NLRB security architect named Daniel Berulis filed a whistleblower complaint alleging that DOGE accounts created at the agency on March 3 downloaded more than 10 gigabytes of sensitive case data, including three GitHub code libraries the agency never used. One of those libraries, an IP-rotation tool for web scraping and brute forcing, matches a program forked in January 2025 by DOGE staffer Marko Elez, who had tenant admin access at the NLRB that was exempt from network logging.
Key Takeaway: The accounts could read, copy, alter, and delete logs of their own activity, so the 10-plus gigabytes of case files covering union organizing and employee information moved without a record the agency's own security staff could see. Berulis said he went public after being told not to report it to US-CERT.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026