Unions Sue Over Elon Musk’s Unprecedented and Illegal Hack of Americans’ Private Data

Allege Serious and Sweeping Breaches of Privacy Act as Personal Info Is Illegally Accessed by Musk Acolytes Operating Inside Federal Buildings

WASHINGTON—A coalition of labor unions representing over 2 million workers filed a federal lawsuit today challenging a data heist carried out by Elon Musk’s so-called Department of Government Efficiency inside three federal government departments.

Six individuals personally harmed by Musk and DOGE’s theft of their private information joined the suit filed by the AFT, the National Active and Retired Federal Employees Association (NARFE), the International Association of Machinists and Aerospace Workers (IAM) and the National Federation of Federal Employees (NFFE). Protect Democracy and Munger, Tolles & Olson are counsel to the plaintiffs.

The suit alleges the Department of Education, the Office of Personnel Management and the Department of Treasury improperly disclosed the sensitive records of millions of Americans to DOGE staff who lack appropriate security clearances and have not been properly vetted, and granted access to some of the government’s most sensitive and closely guarded data systems, in violation of the Privacy Act. DOGE employees include a 19-year-old who has previously leaked proprietary information.

The Privacy Act carefully regulates how agency records about individuals can be shared and disclosures of personal information beyond what the statute authorizes are illegal.

“Steamrolling into sensitive government record systems has led to a massive data breach that threatens to upend how these critical systems are maintained and seriously compromises the safety and security of personal identifying information for Americans all across the country,” the suit, filed in the U.S. District Court for the District of Maryland, reads. “It also violates federal law.”

Plaintiffs include veterans who receive benefit payments, current and former federal employees whose confidential employment files reside in OPM’s system, and teachers whose pathway to the classroom was reliant on student loans to pay for college tuition.

When Americans interact with the U.S. government, they often entrust federal agencies with sensitive personal information; the suit argues that bond of trust has been broken. The Education Department alone oversees the private information of 43 million student borrowers who hold $1.6 trillion in student debt. Treasury’s system contains records relating to every American who receives (among other things) a tax refund, Social Security benefit, veterans pay, or a federal salary. OPM holds exceedingly sensitive personal information for all 2.3 million federal employees.

Plaintiffs are asking the court to impose immediate relief that restores the protections of the Privacy Act. They seek injunctive and declaratory relief to ensure that improper disclosures to DOGE representatives stop immediately and that any data currently in DOGE’s possession be immediately deleted and destroyed.

Enacted in the wake of Watergate, the Privacy Act sought to restore trust in government and to address an existential threat to American democracy.

“Elon Musk and his minions are stealing Americans’ private personal and financial data in one of the biggest data hacks in U.S. history,” said AFT President Randi Weingarten. “I suspect no one who voted for Donald Trump thought he would allow Musk permission to invade their privacy. This is a breach of our fundamental freedoms. Right now, inside the Department of Education, the world’s richest man is rifling through 45 million people’s private student loan accounts and feeding the data into artificial intelligence.

“The department is effectively one of America’s biggest banks—if there was a breach of this magnitude in the private sector, it would rightly be a national scandal. Social Security numbers, financial data, home addresses, and personal demographic data about student borrowers and, in many instances, their parents, spouses or other family members are being illegally vacuumed up by Musk. This lawsuit is being filed to bring an end to his heist before he does irreversible damage to millions more American lives.”

“The federal government holds in trust vast amounts of data about American citizens, including federal employees and retirees,” said NARFE National President William “Bill” Shackelford. “Without legal guardrails in place to prevent improper use of such data, we risk disclosure to nefarious actors, and abuse by individuals within the government itself, threatening personal liberty and property. The Privacy Act provides those legal guardrails, reflecting a balance between the government’s need to utilize such data for legal purposes and its need to protect against abuse and misuse. Violating the Privacy Act infringes upon individuals’ rights that data held in trust is not misused or abused. NARFE joins this suit to ensure the administration is protecting personal data of federal employees and retirees as required by law.”

“Government agencies are not private entities that billionaires can simply buy and rummage through,” said IAM Union International President Brian Bryant. “Congressional oversight, advocacy and voting are how we make government work for us, not reckless takeovers that put the personal data of millions of Americans into the hands of unqualified, unvetted political operatives. It is up to us—the working families of America—to stand up here and now to protect our privacy and our democracy.”

”We're watching in real time as Trump’s cronies break the law to get access to Americans’ most sensitive and personal data," said Kristy Parker, Counsel to the plaintiffs at Protect Democracy. "No one should be fooled into thinking they're doing this for our benefit—to save us money or make our lives better. Their goal is to snoop on vast amounts of Americans' data and try to use what they find to enrich themselves, reward their allies, and punish their critics.”

The full complaint can be read here.