It shouldn’t be. That data never leaves the cloud unless you download it which you wouldn’t do with a phone. Now his *access* details might be and I’ll bet his 2FA is tied to his phone. My guess is his creds were changed ASAP but clearly a huge problem.

I was being facetious. However, the various accounts of the incident open the door to endless speculation. He has been given the task of "improving" the SSA website. At least he kept the Spanish language option.