Social Security Data Breach Lawsuit: What the DOGE Case Is — and Isn’t
Active Litigation
The “social security data breach” in the news is not a hack of the kind that ends in a settlement. It is a set of whistleblower allegations and government admissions that DOGE staff copied and shared Social Security records — and one lawsuit against Social Security by unions and retirees, pending in federal court in Maryland. As of October 15, 2026 there is no social security class action, no settlement, no claim form and no payment.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What the Lawsuit and the Whistleblowers Allege
The Social Security Administration holds what a federal judge called sensitive information about nearly everyone in the United States, and it pays benefits to nearly 72 million people. Its core identity file, Numident, holds Social Security numbers, names, addresses, places of birth and parents’ names.
In February 2025 three organizations sued, alleging that giving the Department of Government Efficiency (DOGE) team broad access to those records violated the Privacy Act and the Administrative Procedure Act. Since then the allegations have grown:
August 26, 2025: SSA’s chief data officer filed a whistleblower complaint alleging DOGE staff placed a live copy of Numident — records on more than 300 million Americans — in a cloud environment without independent oversight. SSA said it was “not aware of any compromise.”
January 16, 2026: SSA filed a “Notice of Corrections to the Record” in the lawsuit. Per the court, it disclosed that DOGE affiliates shared SSA data through the third-party server Cloudflare from March 7 to 17, 2025; emailed a file believed to hold data from the records of some 1,000 people; and that a DOGE affiliate signed a “Voter Data Agreement” with an unnamed political advocacy group on March 24, 2025.
March 2026: a second, anonymous whistleblower alleged that a former DOGE engineer kept copies of Numident and the Master Death File — more than 500 million living and dead Americans — at least one on a thumb drive. SSA, the former employee and his employer deny it; SSA’s inspector general was reviewing the complaint as of March 10, 2026; we found no result.
Case details
The case is American Federation of State, County and Municipal Employees, AFL-CIO v. Social Security Administration, No. 1:25-cv-00596 in the U.S. District Court for the District of Maryland, before Senior Judge Ellen Lipton Hollander. It was filed on February 21, 2025 by AFSCME, the Alliance for Retired Americans and the American Federation of Teachers.
Judge Hollander issued a preliminary injunction limiting DOGE’s access on April 17, 2025. The Supreme Court stayed it on June 6, 2025 (No. 24A1063). On April 10, 2026 the full Fourth Circuit vacated the injunction (172 F.4th 361) and sent the case back. On April 14, 2026 the district court lifted its stay and allowed discovery, and on June 26, 2026 it refused the government’s request to undo that order.
Status: One Lawsuit, No Settlement, No Claim Form
The government has moved to dismiss, arguing the case is moot because SSA no longer has a DOGE team and the DOGE Temporary Organization expired on July 4, 2026. Briefing closed on June 15, 2026. The court’s June 26, 2026 opinion expressly left that motion undecided, and we could not confirm a later ruling.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected — and Who Is a Party
If you have a Social Security number, your record is in Numident — the whistleblower complaint describes it as holding all Social Security numbers issued by the federal government. That is why so many people search for this.
But being in the database does not make you part of a lawsuit. The Maryland case is not a social security class action lawsuit. Its plaintiffs are three organizations suing on behalf of their members, and no class has been proposed or certified. There is nothing to join and nothing to sign up for.
Nor has any court or agency found that specific people’s records were stolen or misused. The allegations concern copying, sharing and access, not a confirmed theft. If you are thinking of the 2024 breach at a private data broker, that is a different matter — see our page on the National Public Data breach lawsuit. For problems with your own benefits, see our Social Security disability lawyer guide.
Is There Money? Not From This Case
Money for individuals would require a different kind of case. The Privacy Act lets an individual sue the United States, and if a court finds the agency acted in a manner that was intentional or willful, it awards actual damages but no less than $1,000 per person, plus costs. Suits must generally be brought within two years of when the claim arises. That is a statute, not a payout: we found no such damages class action against Social Security over the DOGE allegations, and anyone promising you “your $1,000” is describing something that does not exist.
How cases like this one end
Our copy of the federal courts’ own case database covers 11,430 federal civil cases of this typeclosed in U.S. federal district courts between 2015 and 2026, 1% of them filed as class actions:
- 11.8% ended in a settlement recorded by the court. Another 33.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 11.8% and 45%.
- 15.2% were decided on a motion before any trial.
- 1 in 476 reached a trial (0.2%), after a median of 19.1 months.
- Median time from filing to the end of the case: 5.5 months.
- Almost none record a money award in this data (17 of 11,430), and the recorded figures are capped, so we do not publish an average.
These are base rates for this type of case — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Social Security Lawsuit Timeline
February 21, 2025 — Unions and Retirees Sue
AFSCME, the Alliance for Retired Americans and the American Federation of Teachers file No. 1:25-cv-00596 in Maryland, alleging Privacy Act and APA violations.
April 17 and June 6, 2025 — Blocked, Then Unblocked
Judge Hollander limits DOGE’s access with a preliminary injunction. The Supreme Court stays it on June 6, 2025.
August 26, 2025 — The Cloud Copy Allegation
SSA’s chief data officer alleges DOGE put a live copy of Numident, covering more than 300 million Americans, in a cloud environment. SSA says it knows of no compromise.
January 16, 2026 — SSA Corrects the Record
SSA tells the court DOGE affiliates shared data through Cloudflare and that one signed a “Voter Data Agreement” with a political advocacy group.
April 10 and 14, 2026 — Injunction Vacated, Discovery Allowed
The en banc Fourth Circuit vacates the injunction. Four days later the district court lifts its stay and grants the plaintiffs’ discovery motion.
June 26, 2026 — Discovery Order Stands
Judge Hollander denies the government’s motion to rescind. The motion to dismiss as moot remains pending in that opinion; no settlement exists.
Three Things to Watch For
Headlines about every American’s Social Security number create perfect cover for imposters:
“Claim your Social Security settlement” sites
There is no settlement and no claims portal. A page asking for your Social Security number to “check eligibility” is collecting exactly the data the headlines are about.
Calls saying your number was “compromised” or “suspended”
Callers cite the DOGE news to sound credible, then ask you to verify your number or move money. Nothing in this lawsuit involves anyone contacting you, and a court case never requires a payment from you.
“Sign up for the $1,000 DOGE payout”
The Privacy Act’s $1,000 minimum applies only after a court finds an intentional or willful violation in a case you are part of. No such award exists. A sign-up form promising it is a lead harvester or worse.
Social Security Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Was there a Social Security data breach?
Not a confirmed theft. What exists are whistleblower allegations that DOGE staff copied Numident to a cloud environment and, separately, kept copies of SSA databases, plus SSA’s own January 16, 2026 court filing admitting DOGE affiliates shared data through Cloudflare. SSA has said it is not aware of any compromise and denies the thumb-drive allegation.
How do I know if I was affected by a data breach?
For this matter, anyone with a Social Security number has a record in Numident, but no agency has identified individuals whose records were stolen and no notices have been ordered. For an ordinary corporate breach, the company’s notice letter is the evidence — keep it.
Is there a social security class action lawsuit?
Not against SSA over these allegations, as far as we could find. The main lawsuit against Social Security, No. 1:25-cv-00596 in Maryland, is brought by three organizations for their members and seeks court orders, not damages.
Is there a Social Security settlement or claim form?
No. As of October 15, 2026 there is no settlement, no fund, no administrator, no claim form and no deadline.
Where does the lawsuit stand now?
The Fourth Circuit vacated the preliminary injunction on April 10, 2026. The district court allowed discovery on April 14, 2026 and refused to undo that on June 26, 2026. A government motion to dismiss the case as moot was fully briefed by June 15, 2026; we could not confirm a ruling.
What did DOJ admit in January 2026?
In a filing of January 16, 2026, SSA corrected earlier statements to the court: DOGE affiliates shared SSA data through Cloudflare from March 7 to 17, 2025, sent a file believed to contain data on some 1,000 people, and one signed a “Voter Data Agreement” with a political advocacy group. Rep. Nellie Pou wrote on January 22, 2026 that officials cannot confirm what information was accessed or where it may now reside.
Can I sue Social Security myself?
The Privacy Act allows individual suits, with damages of at least $1,000 only if a court finds an intentional or willful violation, and generally within two years. Whether these facts meet that bar is untested. That is a question for a licensed attorney, not a sign-up form.
What is worth doing right now?
Freeze your credit at all three bureaus — free and reversible. Create your own my Social Security account before someone else does, and treat any call about your number being “compromised” as a scam until proven otherwise.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- National Public Data BreachThe 2024 data-broker breach of SSNs, a separate case
- Data Breach Settlement CalculatorWhat breach settlements with Social Security numbers usually pay
- Open Class Action SettlementsSettlements that are taking claims right now
- Social Security Disability LawyerFor benefit denials and appeals rather than data claims