Supreme Court Hacker Posted Stolen Data on Instagram: The Nicholas Moore Case [2025]

When you think about government cybersecurity breaches, you probably imagine shadowy hackers operating in the dark web, using encrypted channels, carefully covering their tracks. But here's what actually happened: a 24-year-old named Nicholas Moore stole sensitive data from the Supreme Court, Ameri Corps, and the Department of Veterans Affairs, then bragged about it on Instagram under the handle @ihackthegovernment.

Yes, Instagram. The same platform where people post their breakfast.

This isn't just another cybersecurity incident to file away in the growing pile of government data breaches. It's a stark reminder that government networks remain vulnerable to determined attackers, that operational security failures can expose millions of Americans' sensitive information, and that sometimes the biggest security threat isn't sophisticated—it's just bold enough to hide in plain sight on social media.

In January 2026, Moore pleaded guilty to the charges, and court documents revealed the full scope of his crimes. What makes this case particularly troubling isn't just what he stole, but how easily he stole it, who he compromised, and how carelessly he exposed the victims. This article breaks down exactly what happened, why it matters, and what it reveals about the state of federal cybersecurity in 2025.

TL; DR

• Nicholas Moore, 24, admitted to hacking multiple federal agencies including the Supreme Court, Ameri Corps, and the Department of Veterans Affairs using stolen employee credentials
• He posted stolen personal data on Instagram under @ihackthegovernment, including victims' names, addresses, Social Security numbers, health information, and military service records
• Moore's breach exposed at least three victims' full identity information and could have compromised thousands more depending on what data he accessed but didn't post
• He faces up to one year in prison and $100,000 in fines, which is surprisingly lenient given the scale of the breach and the sensitivity of the information accessed
• The breach highlights critical failures in credential management, access controls, and security monitoring across multiple federal agencies

Who Is Nicholas Moore? The 24-Year-Old Who Hacked the Federal Government

Nicholas Moore wasn't some legendary hacker with years of experience in underground forums. He was a 24-year-old from Springfield, Tennessee with the audacity to hack multiple federal agencies and then post about it on Instagram like he was sharing memes with his friends.

What we know about Moore comes from court documents and the charges he faced. He didn't use some exotic zero-day exploit or spend months engineering a sophisticated attack. Instead, he did something much simpler and much more terrifying: he used stolen credentials. Somewhere, somehow, he obtained legitimate usernames and passwords belonging to actual federal employees—people authorized to access these systems.

Once he had those credentials, he walked right in. No advanced malware. No social engineering. Just usernames, passwords, and access.

The question that haunts security professionals is obvious: how did Moore get those credentials in the first place? Court documents don't explicitly say, but the most likely scenarios include credential stuffing (using passwords leaked in previous breaches), phishing, or purchase from underground marketplaces where stolen credentials get traded. The federal government's password policies, while improved since 2015, still require updates—many agencies allow passwords that would fail in private sector enterprise environments.

What's particularly damning is that Moore didn't need sophisticated tools or years of hacking experience. He needed patience, audacity, and a platform to brag about it. He had all three.

The Breaches: Supreme Court, Ameri Corps, and Veterans Affairs

Moore didn't just pick one federal agency and move on. Court documents reveal he successfully breached at least three separate federal systems, each with different security architectures and access controls. The fact that he compromised all three using essentially the same method suggests something disturbing: these agencies had significant gaps in their security posture.

The Supreme Court Breach

The Supreme Court operates the Electronic Case Files (ECF) system—a critical infrastructure that handles all the documents, briefs, and filings for cases currently before the nation's highest court. This system contains sensitive legal documents, motion filings, and correspondence that can impact major national decisions.

Moore accessed the account of one victim (identified as "GS" in court documents) and stole electronic filing records. The victim's name and "current and past electronic filing records" were posted to his Instagram account. This breach exposed not just the victim's identity but also their professional work and case history—information that could be used for further targeting, blackmail, or just plain embarrassment.

Here's what makes this particularly serious: the Supreme Court hears cases that shape American law. The ECF system contains documents about constitutional challenges, election disputes, and corporate litigation that affects billions of dollars. The fact that someone could access another person's complete filing history—and then post it publicly—is a fundamental breach of the system's integrity and the confidentiality expected in legal proceedings.

The Ameri Corps Compromise

Ameri Corps runs volunteer programs where Americans serve their communities—community development, education, environmental conservation, disaster relief. The organization manages thousands of volunteers and staff members, many of whom are young people serving their first serious role.

Moore accessed the account of one Ameri Corps victim (identified as "SM") and went significantly further in his exploitation than with the Supreme Court victim. He posted the victim's name, date of birth, email address, home address, phone number, citizenship status, veteran status, service history, and the last four digits of his social security number to Instagram.

Let that sink in for a moment. That's not just "your data was breached." That's a complete identity profile. With that information, an attacker could attempt to open credit lines, file false tax returns, access government benefits, or commit other forms of identity theft. Moore then bragged about having access to Ameri Corps servers—a statement that suggests he may have accessed far more data than just the one victim's information, even if he only posted a portion of it publicly.

The Department of Veterans Affairs Incident

The Veterans Affairs breach might be the most troubling of the three. The VA manages health records for millions of military veterans—information about medications, diagnoses, treatment plans, and medical history. This is protected health information (PHI) under HIPAA, and it's among the most sensitive data the federal government holds.

Moore accessed the My Healthe Vet account of one veteran (identified as "HW") and obtained the victim's identifiable health information, including which medications the veteran had been prescribed. He then sent a screenshot of this information to an associate, which means the breach extended beyond just Moore—he shared the stolen health data with someone else.

Health information is particularly dangerous when compromised because it's permanent. You can change a password. You can dispute fraudulent charges. But health information? That stays with you. Knowing someone's medications can reveal diagnoses that the person may not have publicly disclosed. It can be used for blackmail, insurance fraud, or targeting for medical identity theft.

The fact that Moore accessed VA systems also suggests that veterans across multiple states might have been vulnerable. The VA isn't a small agency—it serves 8.7 million veterans. If Moore could access one veteran's full health information, what's to say he didn't access others and simply didn't brag about them on Instagram?

How Did Moore Access These Systems? The Credential Problem

The mechanics of Moore's attack were surprisingly straightforward, which is exactly what makes it so concerning. He used stolen credentials—legitimate usernames and passwords—to access systems that should have had multiple layers of protection.

This attack vector is called credential-based lateral movement, and it's one of the most effective techniques in the modern attacker's toolkit. Once you have valid credentials, you don't look like an attacker. You look like an authorized user. Your login traffic blends in with legitimate traffic. Your access doesn't trigger alarms because you're not doing anything "abnormal"—you're just accessing the systems your credentials are authorized for.

Why did Moore's access go undetected for what appears to be an extended period? Several possibilities emerge:

Insufficient Logging and Monitoring: Federal agencies were slow to implement comprehensive audit logging and real-time alerting. Some systems may not have been recording which files were accessed, when they were accessed, or from where. Without logs, security teams can't detect anomalous access patterns.

No Multi-Factor Authentication (MFA) at Scale: While many federal agencies have been moving toward MFA, adoption remains incomplete. If a system only requires a username and password—and Moore had those—he gets in regardless of geographic location, device fingerprint, or suspicious access patterns. The federal government's push for zero-trust architecture started in earnest after 2021, but many agencies were still operating with older models in 2025.

Poor Credential Hygiene: Federal employees are busy. They reuse passwords across systems. They write passwords down. They share credentials with colleagues. They don't always use password managers. These are organizational culture problems, not just technical ones, and they're incredibly difficult to solve at scale across thousands of agencies and departments.

Access Creep and Insufficient Segmentation: Employees often accumulate access rights over time. When someone transfers departments or changes roles, their old access may never be revoked. This means a single compromised credential could open doors to systems the account owner never actually uses but is technically authorized for.

Why Did Moore Post Data on Instagram? The Ego Factor

One of the most bizarre elements of this case is Moore's choice to post the stolen data on Instagram. Why would someone conducting sophisticated cybercrimes then document their activities on a platform that literally stores metadata, timestamps, and IP addresses?

The answer reveals something important about modern cybercriminals: not all of them are trying to hide. Some—increasingly—are trying to build a reputation. Moore's Instagram handle "@ihackthegovernment" wasn't a secret. It was a calling card. It was a resume. It was proof.

This phenomenon is becoming more common in cybersecurity circles. Attackers post screenshots of their breaches on Twitter/X, on Reddit's darknet communities, on Telegram channels, and yes, on Instagram. They do it for several reasons:

Reputation and Status: In hacking communities, pulling off a major breach is an achievement that builds your reputation. Moore was essentially claiming credit for hacking the Supreme Court. That's the kind of credential that gets you noticed in underground forums and leads to job offers from ransomware groups, state-sponsored units, or competitive criminal syndicates.

Bragging Rights: At 24 years old, Moore was engaging in behavior common to that age group: showing off, testing boundaries, seeing if he could really get away with something audacious. The difference is that his "prank" involved stealing millions of Americans' personal data.

Operational Insecurity: Ironically, Moore's choice to post on Instagram made him incredibly easy to catch. Once law enforcement was alerted to the breaches (which likely happened when victims reported their stolen data or when the agencies themselves discovered the unauthorized access), investigators just had to follow the public trail. They didn't need to hack into dark web forums or decrypt anonymous communication. They could just look at Instagram.

What Data Did Moore Actually Steal?

Court documents don't provide a complete accounting of everything Moore accessed, only what he posted. This distinction matters because it suggests Moore accessed far more than he bragged about.

The confirmed stolen data includes:

• Supreme Court victim (GS): Full name and complete electronic filing records (identity information, legal case involvement)
• Ameri Corps victim (SM): Name, date of birth, email address, home address, phone number, citizenship status, veteran status, service history, last four digits of Social Security number
• Veterans Affairs victim (HW): Identifiable health information, including specific medication prescriptions

But here's the critical question that court documents don't fully answer: how many other people's data did Moore access that he didn't post? If he compromised one Ameri Corps employee account and one VA account, he likely accessed whatever data those accounts were authorized to view. An HR employee at Ameri Corps might have access to hundreds or thousands of volunteer records. A medical assistant at the VA might have access to records for thousands of patients.

The court documents reveal only what Moore bragged about. The actual scope of the breach could be orders of magnitude larger.

The Legal Response: Charges, Guilty Plea, and Sentencing

Moore pleaded guilty to the charges against him, which is noteworthy because it means the government didn't have to prove its case at trial. He admitted to the crimes. In his guilty plea, he acknowledged accessing federal computer systems without authorization and stealing personal information.

The maximum penalties Moore faces are surprisingly lenient for the scope of his crimes:

• Up to 1 year in federal prison
• Up to $100,000 in fines

For context, consider what Moore actually did: he breached the Supreme Court, compromised two other federal agencies, stole the identity information of multiple people including a veteran, and exposed someone's health information. That's a maximum prison sentence of 12 months and fines that amount to what the average American makes in about two years.

The actual sentence imposed isn't detailed in available court documents, but federal sentencing guidelines suggest that Moore will likely face something less than the maximum. First-time offenders, youth, and guilty pleas typically result in sentences that are 30-50% of the maximum.

This raises questions about how seriously the federal government treats cybercrime. A person who steals a car goes to prison longer than someone who breaches the Supreme Court's electronic filing system. A person who assaults someone might face penalties equivalent to what Moore will likely receive. Meanwhile, he compromised the constitutional infrastructure of the United States.

Federal Cybersecurity: Still Vulnerable in 2025

The Moore case doesn't occur in a vacuum. It's the latest in a decades-long pattern of federal cybersecurity failures. Understanding why Moore succeeded requires understanding the broader landscape of federal IT infrastructure and security practices.

Legacy Systems and Technical Debt

Many federal agencies still operate on systems that are 20, 30, or even 40 years old. COBOL code from the 1980s still runs critical infrastructure at agencies like the Social Security Administration and the IRS. These legacy systems were never designed with modern security in mind. They run on networks that weren't built to be zero-trust. They use authentication mechanisms that predate the internet.

Modernizing these systems costs billions of dollars and requires retraining thousands of employees. It's easier to just patch the problems and hope nobody notices the vulnerabilities. Until someone like Nicholas Moore notices them and decides to exploit them on Instagram.

Budget Constraints and Competing Priorities

Federal agencies operate under budget constraints that private companies don't face. When you're an agency director and you have to choose between funding cybersecurity improvements or funding the actual mission you're responsible for—let's say, processing Social Security benefits or providing VA healthcare—cybersecurity improvements often lose.

A federal IT director might need

Staffing and Expertise Gaps

The federal government struggles to attract and retain top cybersecurity talent. Private companies offer higher salaries, more flexible work arrangements, and more interesting technical challenges. Federal agencies operate under pay scales and hiring rules that make it difficult to compete with industry. This leads to understaffed security teams trying to protect massive networks with limited resources.

A private company's security team might have one expert for every 50-100 systems. A federal agency might have one expert for every 500-1000 systems. The work is overwhelming, and turnover compounds the problem because institutional knowledge walks out the door when experienced staff leave.

The Victims: What Getting Breached at a Federal Agency Means

The three people identified as "GS," "SM," and "HW" in court documents aren't abstract victims. They're real people whose information was stolen and broadcast on Instagram by someone who was essentially anonymous to them.

Victim SM: The Ameri Corps Breach

Victim SM had the most complete identity information exposed: name, date of birth, email, home address, phone number, citizenship status, veteran status, service history, and last four SSN digits. That's not a data breach. That's an identity profile.

For an Ameri Corps volunteer or staff member, this exposure could mean years of identity theft problems. Credit cards opened in their name. Tax returns filed fraudulently. Medical debt accrued under their identity. While federal law provides some protections and allows victims to dispute unauthorized charges, the process is tedious, time-consuming, and sometimes incomplete.

SM might spend hundreds of hours over the next 3-5 years dealing with the consequences of Moore's breach. And they never did anything wrong. They were just working for a federal agency.

Victim HW: The Health Information Exposure

Victim HW's exposure was different but potentially more serious long-term. Their prescription information was stolen and shared. Depending on what medications were listed, this could reveal diagnoses:

• Antiretroviral medications reveal HIV status
• SSRI antidepressants reveal mental health diagnoses
• Insulin reveals diabetes
• Statins reveal cardiovascular disease risks

Health information is uniquely sensitive because once it's public, it's permanent. A breached password can be changed. A compromised credit card can be canceled. But health data? That stays with you. It can affect insurance, employment, relationships, and personal privacy in ways that other data breaches cannot.

Victim GS: The Supreme Court Filing Records

Victim GS's exposure was more professional than personal, but still significant. Their complete electronic filing record—every case they worked on, every document they filed, every motion they made—was publicly available on Instagram. For a lawyer, law clerk, or legal professional, this is professionally embarrassing and potentially compromising if cases involved sensitive matters.

All three victims now have to live with the knowledge that their information was stolen by a 24-year-old and posted on social media. They'll spend time and money addressing the consequences. And in many cases, there's no meaningful restitution because Moore is 24 years old from Tennessee and will likely serve minimal prison time.

Credential Security: The Foundation That Failed

At the root of Moore's successful breaches was a fundamental failure in credential security. This isn't a novel vulnerability or a complex attack. This is basic cybersecurity hygiene that has been standard practice in the private sector for a decade.

Multi-factor authentication (MFA) prevents the exact attack Moore executed. If the federal employees Moore targeted had been required to use MFA—a password plus a code from an authenticator app, a text message, or a hardware key—Moore's stolen passwords would have been useless. He'd need the second factor, which he wouldn't have.

The federal government has been slowly implementing MFA since around 2015, when the Office of Management and Budget (OMB) started pushing for it. But "slowly" is the operative word. In 2025, not all federal systems require MFA. Some employees still log in with just a username and password, especially to legacy systems.

Why? The usual reasons: cost, complexity, user friction, and competing priorities. MFA takes time to implement at scale. Users have to get authenticator apps or hardware keys. Support staff have to deal with lockouts when users lose their second factor. It's easier to just use passwords.

Except when it's not. Except when someone like Nicholas Moore gets the credentials and walks right in.

The Broader Picture: Government Cybersecurity in 2025

The Moore case is one incident among many. Federal agencies face constant attack from:

• State-sponsored attackers from Russia, China, Iran, and North Korea probing networks for vulnerabilities and stealing intellectual property
• Ransomware gangs targeting hospitals, schools, and municipal governments (federal agencies are better defended but not immune)
• Commercial spies trying to steal procurement information, research data, and competitive intelligence
• Hacktivists trying to make political statements
• Script kiddies like Moore, just trying to see if they can do it

The federal government has made improvements. Agencies report to the Cybersecurity and Infrastructure Security Agency (CISA). There are incident response protocols. There's coordination across agencies. But the Moore case shows that these improvements haven't been universal or fast enough.

The attack surface is enormous. Thousands of federal agencies. Millions of employees with network access. Systems spanning decades of technological change. Legacy infrastructure running alongside modern cloud deployments. The challenge isn't finding vulnerabilities. It's fixing them faster than attackers can exploit them.

What Needs to Change: Federal Cybersecurity Improvements

The Moore case is a wake-up call about what needs to happen in federal cybersecurity. Some improvements are technical. Others are organizational.

Mandatory Multi-Factor Authentication

Every federal system that isn't already using MFA should implement it. This should be mandatory, not optional. The cost is relatively low. The benefit is enormous. A stolen password is no longer sufficient for access. This eliminates the attack vector Moore exploited.

Zero-Trust Architecture

The federal government has been adopting zero-trust principles since around 2020, but adoption is incomplete. Zero-trust means assuming that every access request could be malicious—even if it's coming from someone with valid credentials. Systems should verify every transaction, segment networks so lateral movement is difficult, and implement least-privilege access so compromised accounts can't see everything.

Moore's breach exploited the opposite of zero-trust. He got credentials and could access whatever those credentials allowed. With zero-trust, he'd face verification challenges even with valid credentials.

Real-Time Monitoring and Alerting

When someone accesses a Supreme Court filing they've never accessed before, at 3 AM from an unusual location, that should trigger an alert. When someone downloads an unusually large amount of data from the VA system, that should be flagged. When credentials are used in ways inconsistent with that employee's normal patterns, security teams should be notified.

This requires comprehensive logging, behavioral analytics, and 24/7 security operations centers. It's expensive, but it's also how you catch breaches in progress instead of finding them on Instagram after the fact.

Incident Response Protocols

When a breach is discovered, the response needs to be fast. In Moore's case, the attack was likely discovered when users reported their stolen data or when the agencies themselves found evidence of unauthorized access. A faster discovery would have meant less time for Moore to exfiltrate data and post it online.

Security Culture and Training

Technology solves some problems, but not all. Federal employees need regular security training. They need to understand why password sharing is dangerous. They need to know how to recognize phishing. They need to report suspicious activity. Building a security-conscious culture takes time and sustained effort, but it's essential.

Lessons for Private Sector Organizations

If the federal government—with all its resources, expertise, and attention to national security—can still be breached by a 24-year-old using stolen credentials, what does that mean for private companies?

It means that credential security is foundational. It means that MFA should be non-negotiable. It means that monitoring, logging, and real-time alerting matter. It means that security culture and training are investments, not expenses.

Private companies have advantages that the federal government doesn't. They can move faster. They can update systems without navigating government procurement processes. They can hire top talent with attractive salary packages. They can experiment with new security approaches.

But they also face the same fundamental challenges: legacy systems, budget constraints, staffing limitations, and the eternal tension between security and usability. Moore's breach offers lessons that apply to any organization with sensitive data and network access.

The Path Forward: What Gets Better from Moore's Prosecution

Moore's guilty plea and the publicity around his case might actually accelerate federal cybersecurity improvements. When a case is this public—when the hacker bragged on Instagram about hacking the Supreme Court—it becomes impossible for agencies to ignore the problem.

Expect:

• Accelerated MFA deployment across federal systems, with OMB directives making it mandatory with specific timelines
• Increased funding for federal cybersecurity modernization in budgets for 2026 and beyond
• Expanded incident response capabilities and hiring of security personnel at federal agencies
• Stricter penalties for cyber crimes involving government systems (though Moore's sentence may remain lenient due to his age and guilty plea)
• Increased coordination between CISA and individual agencies on vulnerability management and incident response

The government is rarely fast to change, but when something as high-profile as a Supreme Court breach happens, things move. Moore's case will likely be cited for years as the wake-up call that forced federal agencies to finally take credential security seriously.

The Human Cost: Beyond the Statistics

When we talk about "data breaches" and "unauthorized access," it's easy to reduce victims to statistics. But the three people Moore targeted—the Supreme Court employee, the Ameri Corps worker, and the veteran—are real people dealing with real consequences.

Victim SM might spend the next five years dealing with fraudulent credit accounts and identity restoration. Victim HW might worry forever about who knows their health information and what could be done with it. Victim GS might feel violated by the invasion of their professional privacy.

Meanwhile, Moore faces a maximum of one year in prison and $100,000 in fines—penalties that seem absurdly light for violating the security of the federal government's infrastructure and stealing the personal information of multiple people.

There's an asymmetry here. The attackers face minimal consequences. The victims face years of consequences. The government's response is slow. The political will to truly modernize security infrastructure is uncertain.

Moore's case isn't just a story about cybersecurity failures. It's a story about victims whose privacy was violated by someone who is unlikely to serve significant time for doing so. It's a story about a federal government struggling to protect its own infrastructure. It's a story about the distance between what we say about security and what we actually do about it.

What This Means for Your Data in Government Systems

If you have data in federal government systems—which most Americans do—the Moore case should concern you. It demonstrates that:

1. Your data isn't as secure as you might think. Federal agencies don't have perfect security. Far from it.

2. Stolen data can be personal and embarrassing. Moore didn't just access names and email addresses. He got health information, service records, and filing histories.

3. Detection is slow and often happens after data is already compromised. Moore might have had access for weeks or months before being caught.

4. Consequences for attackers are limited. A 24-year-old who breaches the Supreme Court might not serve significant prison time.

You can't opt out of federal government systems if you're a veteran, work for a federal agency, or have legal matters before federal courts. But you can take steps to protect yourself: monitor your credit regularly, set up fraud alerts, use strong unique passwords everywhere, and enable MFA whenever it's available.

Moore's breach is a reminder that security is everyone's responsibility, not just the government's. And it's a reminder that the government, despite all its resources, is still fighting a losing battle against determined attackers operating with basic but effective techniques.

FAQ

What exactly did Nicholas Moore do?

Nicholas Moore, a 24-year-old from Springfield, Tennessee, used stolen credentials to access computer systems at the U. S. Supreme Court, Ameri Corps, and the Department of Veterans Affairs. Once he gained access, he stole personal information from the systems and posted some of it on his Instagram account (@ihackthegovernment), including names, addresses, Social Security numbers, health information, and military service records.

How did Moore gain access to federal government systems?

Moore used stolen usernames and passwords—valid credentials belonging to federal employees who were authorized to access the systems. There are no details in court documents about how he originally obtained these credentials, but common methods include credential stuffing (using leaked passwords from other breaches), phishing, or purchasing credentials from underground marketplaces where stolen data is traded.

What personal information was exposed?

The exposed information included victims' full names, dates of birth, email addresses, home addresses, phone numbers, citizenship status, veteran status, military service history, partial Social Security numbers, prescription medication information, and electronic filing records. The VA breach exposed identifiable health information that could reveal diagnoses.

Why did Moore post the stolen data on Instagram?

Moore posted the data under the handle @ihackthegovernment as a way to build reputation in hacking communities, claim credit for major breaches, and demonstrate his skills. This bragging actually made him easy to catch, as law enforcement simply had to follow the public trail of Instagram posts to identify and prosecute him.

How many people were affected by Moore's breach?

Court documents reveal the confirmed theft and posting of data from at least three identified victims (Supreme Court, Ameri Corps, and Veterans Affairs). However, the actual scope of the breach could be much larger—Moore may have accessed far more data than he posted publicly, but this isn't detailed in available documents.

What is Moore facing as punishment?

Moore pleaded guilty to the charges and faces a maximum sentence of one year in federal prison and a $100,000 fine. The actual sentence imposed hasn't been publicly disclosed, but first-time offenders with guilty pleas typically receive sentences 30-50% of the maximum, suggesting he may serve significantly less than one year.

Why couldn't the federal government stop Moore's access sooner?

Several factors enabled Moore's prolonged access: insufficient real-time monitoring and alerting systems, lack of multi-factor authentication (MFA) on some systems, inadequate logging and audit trails, and poor credential management practices. Many federal systems still run on legacy infrastructure not designed with modern security practices in mind, making them vulnerable to credential-based attacks.

Is the federal government fixing these security vulnerabilities?

Yes, but progress is slow. Federal agencies have been implementing multi-factor authentication, zero-trust architecture, and improved monitoring capabilities since around 2015-2020. However, adoption has been incomplete and uneven across agencies. Moore's high-profile case is likely to accelerate improvements, particularly around mandatory MFA deployment and increased funding for cybersecurity modernization.

What should I do if I think my data was exposed in this breach?

If you're a Supreme Court employee, Ameri Corps worker, or Veterans Affairs patient, monitor your credit reports regularly and consider placing a fraud alert with the three major credit bureaus (Equifax, Experian, Trans Union) or freezing your credit. The government should have notified affected individuals, but if you haven't received notification and you work for one of these agencies, contact the agency's security or HR department directly.

How common are breaches like Moore's in federal government systems?

Data breaches and unauthorized access are unfortunately common in federal government systems. Agencies report thousands of incidents annually to CISA. However, most don't result in criminal prosecution, and many aren't public. Moore's case is notable because he was caught and prosecuted, and because he publicly bragged about his crimes on social media, making it a rare publicly documented federal breach case.

Could Moore have successfully hidden his breach?

Almost certainly yes. His biggest mistake was posting about it on Instagram. If he had simply stolen the data and sold it on dark web markets without bragging, law enforcement might never have discovered him. His need to take credit for the breach—to build his reputation—is what led to his arrest and prosecution, suggesting that operational security failed through ego rather than through technical detection of the intrusion itself.

The Nicholas Moore case represents a collision between modern cybersecurity realities and federal government vulnerabilities. It shows that sophisticated hackers aren't always needed to breach critical infrastructure—sometimes basic credential security failures are enough. It shows that even the highest institutions in American government remain vulnerable to determined attackers. And it shows that the path forward requires not just better technology, but faster implementation, better staffing, and serious cultural shifts around how federal agencies approach security.

Moore is unlikely to serve significant time for his crimes. But his Instagram account and court documents will serve as a reminder for years about what happens when credential security fails and when operational insecurity meets audacity.