A federal judge said on Thursday the Social Security Administration likely violated privacy laws by giving tech billionaire Elon Musk’s aides “unbridled access” to millions of Americans’ private data, and ordered a halt to any further record sharing.

U.S. District Judge Ellen Lipton Hollander of Maryland said Musk’s Department of Government Efficiency was intruding into “the personal affairs of millions of Americans” as part of its hunt for fraud and waste under President Donald Trump.

“To be sure, rooting out possible fraud, waste, and mismanagement in the SSA is in the public interest. But, that does not mean that the government can flout the law to do so,” Hollander said.

The case has shed light for the first time on the amount of personal information that DOGE staffers have been given access to in the databases, which hold vast amounts of sensitive information on most Americans.

One of the systems accessed is called Numident, or Numerical Identification, known inside the agency as the “crown jewels,” three former and current SSA staffers told Reuters. It contains personal information of everyone who has applied for or been given a social security number since the agency was founded in the 1930s.

DOGE did not immediately respond to a request for comment.

A White House spokesman criticized the decision in a statement and said Trump will “continue to seek all legal remedies available to ensure the will of the American people goes into effect.”

“This is yet another activist judge abusing the judicial system to try and sabotage the President’s attempts to rid the government of waste, fraud, and abuse,” spokesman Harrison Fields said.

The two labor unions and an advocacy group that sued SSA, Musk, DOGE and others, claimed in their lawsuit the agency had been “ransacked” and that DOGE members had been installed without proper vetting or training, and demanded access to some of the agency’s most sensitive data systems.

The lawsuit was brought by the advocacy group Democracy Forward. The group’s CEO Skye Perryman said the ruling was an important win for data privacy.

“Today, the court did what accountability demands – forcing DOGE to delete every trace of the data it unlawfully accessed. The court recognized the real and immediate dangers of DOGE’s reckless actions and took action to stop it,” Perryman said in a statement.

Hollander said at the heart of the case was a decision by new leadership at the SSA to give 10 DOGE staffers unfettered access to the records of millions of Americans. She said lawyers for SSA had acknowledged that agency leaders had given DOGE access to a “massive amount” of records.

“The DOGE Team is essentially engaged in a fishing expedition at SSA, in search of a fraud epidemic, based on little more than suspicion. It has launched a search for the proverbial needle in the haystack, without any concrete knowledge that the needle is actually in the haystack,” Hollander said.

The information in SSA’s records includes Social Security numbers, personal medical and mental health records, driver’s license information, bank account data, tax information, earnings history, birth and marriage records, and employment and employer records, the judge added.

Hollander noted that the DOGE staffers had been granted anonymity in the proceeding due to fears for their safety.

“(The) defense does not appear to share a privacy concern for the millions of Americans whose SSA records were made available to the DOGE affiliates, without their consent, and which contain sensitive, confidential, and personally identifiable information,” the judge added.