The specialist, Daniel Berulis, made the allegations in a sworn declaration submitted to members of Congress and to a federal whistleblower office, asking them to investigate what he called a cybersecurity breach. His lawyer said that Berulis had also been targeted with a threatening note and photographs showing him near where he lives.

Berulis, who works at the labor board, wrote in the declaration that within days of DOGE staffers arriving in March, he noticed a series of “anomalous” events in the board’s computer systems. Those included changes to the use of multi-factor authentication, which is a widely used security protocol, and internal alerting systems being switched off, he wrote in the 14-page statement.

He also wrote that he tracked what appeared to be the outbound transfer of around 10 gigabytes or more of data — He wrote that the removal was “extremely unusual because data almost never directly leaves NLRB’s databases.”

The database accessed by DOGE contained personally identifiable information of “claimants and respondents with pending matters before the agency” as well as confidential business information gathered during investigations, he wrote.

He added that after DOGE gained access to the labor board’s systems, there was an increase in attempted logins from locations outside the United States including from a user with an internet protocol (IP) address in Russia. He wrote that the person with the Russian IP address appeared to have a correct username and password, created minutes earlier by DOGE engineers, and was blocked from logging in only because of their location.

“Those attempts were blocked, but they were especially alarming,” Berulis wrote.

Berulis included in his disclosure several screenshots from a computer workstation that he says are evidence of data being transferred. He wrote that he has almost two decades of experience in his field and that he has held a Top Secret security clearance.