Bluesky Blocks Links to 40,000 DHS Records as Icepick Goes Offline

Summary

Bluesky began marking links to transparency collective DDoSecrets as malicious after a hacker obtained more than 40,000 account records from the U.S. Department of Homeland Security login system. The data includes names, work phone numbers and work email addresses for employees and agents across agencies including Customs and Border Protection and Immigration and Customs Enforcement. Bluesky said the exposed data violates its community guidelines, but blocked the destination rather than deleting posts. DHS said Wednesday it was aware of a potential breach and was working to address it, while Bluesky did not respond outside U.S. West Coast business hours.

DDoSecrets published the business card-like data in the public interest. Co-founder Emma Best said it contains professional contacts, not home addresses or personal contacts, and could help researchers file Freedom of Information Act requests concerning Trump administration abuses. By Thursday morning, journalist maia arson crimew’s searchable Icepick site was offline after its CentralNic-hosted domain entered serverHold status. DHS submitted a takedown notice through ZeroFox, authorized to act for the department through 2028, asking the registrar to stop serving personal contact and location data published without consent. CentralNic did not say whether it acted on a government demand, while ZeroFox and DHS did not answer follow-ups. Crimew also released a locally hosted version that users can access on their own computers.