A federal judge in New York granted the 19 states suing over DOGE’s access to highly sensitive taxpayer records a temporary restraining order.

Judge Paul Engelmayer wrote that the court believed the plaintiffs would face “irreparable harm in the absence of injunctive relief.”

“That is both because of the risk that the new policy presents of the disclosure of sensitive and confidential information and the heightened risk that the systems in question will be more vulnerable than before to hacking,” the judge wrote.

Nineteen states sued the Trump administration to block government employees associated with Elon Musk’s Department of Government Efficiency from accessing taxpayer records, including the Social Security numbers and bank account information of millions of Americans.

The lawsuit — filed by New York Attorney General Letitia James and 18 other state attorneys general — alleged the breach of sensitive Treasury Department data “poses huge cybersecurity risks” and violates multiple federal laws.

“This new expanded access policy poses huge cybersecurity risks that put vast amounts of funding for the States and their residents in peril,” the lawsuit said.

James hailed the decision in a post on X Saturday: “This morning, we won a court order blocking Elon Musk, the world’s richest man, from accessing Americans’ private data. Musk and his DOGE employees must destroy all records they’ve obtained.”

Filed in the Southern District of New York, the lawsuit asked the court to issue an order that would prohibit so-called “special government employees” associated with DOGE from accessing records held by the Bureau of Fiscal Service (BFS), which functionally serves as the checkbook for the federal government.

The lawsuit comes as Musk’s unprecedented budget-slashing has impacted nearly every department of the federal government, prompting multiple federal lawsuits. On Wednesday, a federal judge temporarily blocked DOGE from accessing Treasury Department records, though two employees of the Treasury Department associated with Musk continue to have “read only” access to the records.

“All of the States’ residents whose [personal identifiable information] and sensitive financial information is stored in the payment files that reside within the payment systems are at risk of having that information compromised and used against them,” the lawsuit said.

The state attorneys general argued that DOGE is interfering with congressionally appropriated funds, violates the Administrative Procedures Act by being “arbitrary and capricious,” and violates both separation of powers doctrine and Trump’s obligation to faithfully execute the law.

The lawsuit also raised concerns that Treasury Secretary Scott Bessent changed longstanding data protection rules to allow DOGE employees to access taxpayer data, violating his legal obligation to protect the private information of veterans, retirees and taxpayers whose private data is held by the Treasury Department.

“Allowing DOGE SGEs access to sensitive information lacked a rational basis and was unreasonable, particularly given the lack of transparency about DOGE’s members, their qualifications, security clearance, their job duties, and the scope of their access,” the lawsuit said.