BLS's CPI and Jobs Data Leaked Three Times in 2024

The title of the Department of Labor Inspector General's June 2026 audit⧉ says BLS "reduced risk" of leaking its own economic data early.▸ The report underneath that title describes three separate incidents in 2024 where it didn't: CPI and Real Earnings figures reached 72 internet providers 31 minutes before the scheduled release; a jobs-data benchmark went out by phone and email to whoever called during a 34-minute delay; and internal CPI methodology -- material BLS never intended for the public -- reached 76 people at banks, investment firms, and trading companies across three separate emails. Each incident produced a BLS fix. None of the fixes were tested against the failure mode that came next.

On May 15, 2024, a BLS IT contractor started the process of moving CPI and Real Earnings data to the public server at 7:58 a.m. instead of the authorized 8:00 a.m.⧉ -- two minutes early.▸ That should not have mattered: BLS's new data-replication software was supposed to block any public copy before 8:30 a.m. Instead, gaps in the software let an automatic task publish the data at 7:59 a.m., 31 minutes ahead of schedule, after the software found an alternate server port and file-transfer method once its designated one was blocked by BLS's firewall rules. Seventy-two internet service providers accessed the data during the 31-minute window before the official release.

The audit found the real failure predates the incident⧉: BLS could not produce the documentation its own Configuration Management Plan requires for a change this size -- no support-ticket record of who reviewed or authorized it, no security-impact evaluation, and a lost version history, blamed on staffing turnover during the rollout.▸ The software that eventually leaked the data was tested only against scenarios where staff followed the process correctly. Neither BLS policy nor its draft testing procedures required what auditors call "negative testing" -- deliberately trying to break the safeguard with an early start, a wrong port, an invalid input -- the exact failure that happened for real three months after the software went live.

The second incident needed no software bug.▸ On August 21, 2024, BLS's Current Employment Statistics preliminary benchmark -- normally published quietly once a year through a manual workaround -- missed its 10:00 a.m. release by 34 minutes because a manually inserted file kept the previous day's timestamp⧉, and BLS's own safeguards block anything modified outside a 90-minute pre-release window. During those 34 minutes, callers and emailers asking why the website still showed last year's numbers got an answer: a BLS supervisor cited what the audit calls an informal CES Program policy and had the still-unpublished figures emailed to customer-service staff, who then read them out by phone or sent them by email -- to whoever happened to ask, before the public release. BLS has had trouble publishing this same benchmark in three of the last four years.

The third incident is the one with no leaked file, only leaked explanations.▸ Between January and February 2024, a BLS employee sent internal CPI methodology explanations to external users in three separate emails -- 19 recipients, then 7, then 50⧉ -- after banks, investors, and traders asked about an unexplained used-car pricing change and an odd pattern in the shelter-cost data. The employee copied and pasted internal, jargon-heavy explanations from BLS subject-matter experts straight into the external replies; one, on February 15, included an inaccurate conclusion about the shelter-data anomaly that wasn't corrected publicly until BLS published its own explanation two weeks later and held a webinar the week after that. Internally, the employee labeled the recipients "super users." The audit's finding on that label is exact: BLS insists it maintains no such formal group or list -- but for three straight events, the same term captured the same practical reality, a subset of sophisticated market participants receiving analysis the general public did not.

The CPI employee's supervisor was copied on every email and had told the employee to consult a subject-matter expert -- but never reviewed a draft before it went out.▸ Nobody caught the pattern through the review chain at all⧉; a different, more senior BLS employee happened to notice the inaccurate February 27 email on their own.

BLS has a written breach-reporting procedure and a Crisis Communication Plan that requires senior leadership be looped in within minutes.▸ In all three incidents, staff went around both⧉. After the February 27 CPI email, the sender's supervisor had it retracted -- 90 minutes later -- instead of reporting a breach; the office's Associate Commissioner learned what happened from a post on X. After the May 15 early release, a BLS IT Specialist spotted the leaked data at 8:19 a.m., 20 minutes after it actually went live, but the chain of notifications took roughly another 36 minutes to reach the Commissioner. And on August 21, the Crisis Communication Plan calls for senior leadership to be told within 5 minutes of a reported crisis; it took 47 minutes from the scheduled release time -- and by then, senior leadership had already found out not from BLS's own reporting chain, but from the Department of Labor's Director of Public Affairs.

That last failure carries a detail the audit states almost in passing: BLS's Crisis Communication Plan, dormant since its 2017 creation, only "resurfaced" in August 2024⧉ after the Communications Director who maintained it had left.▸ BLS ran a tabletop exercise on August 20, 2024, walking staff through exactly this scenario -- an early release, a late release, a damaging public statement. The plan failed for real the very next morning.