Cutbacks bite back as hackers play with Musk's DOGE site
Musk’s DOGE efforts to lower federal expenses may be a victim of its own quest for efficiency, with lax cybersecurity practices allowing anyone to access the government’s newly created website.
Image by Cybernews
Musk’s DOGE efforts to lower federal expenses may be a victim of its own quest for efficiency, with lax cybersecurity practices allowing anyone to access the government’s newly created website.
The recently created Department of Government Efficiency, or DOGE, run by tech billionaire Elon Musk, has declared a “war on waste.”
The department started slashing federal spending by cutting funding to numerous organizations and drastically overhauling or eliminating government employees, agencies, and programs.
With a proposition to improve and optimize the government's work, the department has apparently saved too much on its own website. Hackers have pointed to the simple truth – the DOGE.gov website is full of critical security loopholes.
Seemingly built overnight, the website replicates DOGE’s X account posts alongside key statistics about the US federal workforce. Hackers, who first shared their security findings with 404 Media, accessed the website's databases, which were publicly open.
Anyone could edit the information stored there. The hackers left messages such as “this is a joke of a .gov site” and “THESE ‘EXPERTS’ LEFT THEIR DATABASE OPEN – roro,” which, at the time of writing, are still visible on the live government page.
According to the developers, who chose to remain anonymous for security reasons, the website is hosted on a Cloudflare Pages site rather than government servers.
“Basically, doge.gov has its codebase, probably through GitHub or something. Doge.gov is a custom domain on their pages.dev URL is set to,” shared one of the sources.
“Rather than having a physical server or even something like Amazon Web Services, they’re deploying using Cloudflare Pages, which supports custom domains.”
The developers suggest that the website’s database is accessible to third parties, allowing them to modify its content, which then appears on the live site. After studying the website's architecture and finding the database's API endpoints, they were able to push updates to a database of government employment information.
Reportedly, another DOGE website – waste.gov – has been left live with WordPress default template and sample text. After being noticed by the media, DOGE took action and barred the demo website behind a password.