Cybersecurity "expert" here. This seems to be under-hyped, if possible. If there were login attempts that even appeared to be coming from Russia using valid credentials that were created less than an hour before, it can really only be explained by collusion or an attacker having visibility into the process that created the credentials in the first place.

The fact that the traffic appeared to be coming from Russia isn't particularly compelling, as it's very easy to make your web traffic appear to be coming from another country. But I struggle to understand why a legitimate user of those credentials would willfully make their legitimate use of government systems appear to be coming from an adversary.

From a cursory read, it says "DOGE came in, were given super-admin access without following procedures, and without a written track, and then plenty of logging was disabled and strange stuff started appearing".

If you ask me, it's the equivalent of the FBI inviting themselves into your home, telling you to "not come back until tomorrow" and then bugging it cellar to roof.

Obviously you have to trust the guy, but if you do this part is already extremely damning.

>received a call during which an ACIO stated instructions were given that we were not to adhere to SOP with the doge account creation in regards to creating records. He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees. DOGE officials required the highest level of access and unrestricted access to internal systems. They were to be given what are referred to as “tenant owner” level accounts

If you seek the opinion of a "security expert" I'd recommend reading the sworn affidavit in Exhibit A. He seems competent, and perjury there seems less likely than here on HN. It's quite well formulated.

I mostly make tooling for the blue team, so i'm not a true expert. The network part is correct, that's how you would do it, the rest i'm not competent except to judge the security practices.

It seems the witleblower is _very_ competent and the story checks out (i know only two persons that could do that alone and that quick and they are true greybeards who've seen it all). Impressive work.

So either he is very well prepared and built an extremely good lie (frankly i don't see why, his discoveries will be audited and the only stuff he did was show how good of an engineer he is), or US government systems are indeed breached, and probably because of those "DOGE" accounts. Is it by malice, greed or incompetence? Malice is out imho, my bet is on incompetence.

still feels like until we get some more grounded evidence, it's speculation:

"Mr. Berulis is coming forward today because of his concern that recent activity by members of the Department of Government Efficiency (“DOGE”) have resulted in a significant cybersecurity breach that likely has and continues to expose our government to foreign intelligence and our nation’s adversaries"

operative words here being "likely has"