NLRB Data Exfiltration

The NLRB data exfiltration was a 2025 incident in which engineers from the Department of Government Efficiency (DOGE) accessed National Labor Relations Board (NLRB) systems and exfiltrated large volumes of sensitive data including union-organizing and labor-complaint records. The exfiltration was followed by multiple blocked login attempts to NLRB systems from an IP address in Russia, raising the documented concern that the exfiltrated data had been exposed to foreign adversaries. Daniel Berulis, an NLRB cybersecurity staffer, disclosed the incident in a sworn affidavit in April 2025, represented by Andrew Bakaj of Whistleblower Aid.¹²³

The DOGE Access and the Data Exfiltration

Berulis documented in his sworn affidavit that DOGE engineers accessed NLRB systems using methods his affidavit characterized as secretive and suspicious. The access coincided with unusual large data outflows from NLRB systems. The exfiltrated data included records related to union-organizing campaigns and labor complaints, which is the NLRB's core case-management data and which contains identifying information on workers involved in organizing activity, the employers they filed against, and the status of the cases.¹²⁴

The data outflow was documented in the NLRB's own system logs, which Berulis reviewed as part of his cybersecurity role. The volume and pattern of the outflows were inconsistent with normal NLRB operations, and the DOGE engineers' access methods (which Berulis described as bypassing normal access controls) were inconsistent with the standard federal-system-access protocols. The Krebs on Security reporting (April 2025) provided the technical detail on the outflow pattern and the access methods.²

The Russian IP Access Attempts

Following the DOGE access, NLRB systems logged multiple blocked login attempts from an IP address in Russia. The timing of the Russian attempts (immediately following the DOGE exfiltration) and the targeting of the systems DOGE had accessed produced the documented concern that the exfiltrated data had been transmitted to or made accessible to a Russian endpoint. The Nextgov/FCW reporting (April 2025) documented the Russian IP attempts and their temporal relationship to the DOGE access.³⁵

The Russian IP access attempts are the documented datum that connects the Elon Musk-led DOGE to the broader Buma-documented pattern of Russian-intelligence interest in U.S. technology and government principals. The Buma disclosures (May 2025) on the GRU targeting of Musk, the documented Musk-Putin contact channel (WSJ October 2024), and the NLRB Russian-IP attempts together constitute the evidentiary set on the question of Russian access to federal data through the DOGE channel.⁶

The Berulis Disclosure and the Aftermath

Berulis came forward in April 2025 with a sworn affidavit through Whistleblower Aid, represented by chief counsel Andrew Bakaj. NPR, PBS NewsHour, Krebs on Security, and Nextgov/FCW each published detailed reporting on the disclosure in April 2025. VitalLaw characterized the incident as an "alarming data breach" that "might have exposed agency data to foreign adversaries."¹²³⁴⁵

After Musk publicly called Berulis a criminal on X, Berulis's brake lines were cut. Berulis is suing Musk for defamation. The physical intimidation of a federal cybersecurity whistleblower who disclosed the Russian-IP-connected exfiltration of union-organizing data is part of the documented aftermath of the disclosure.⁷