Two Marines Take the Pentagon to Court Over a Breach That Left 3 Million People’s Records Exposed for Nine Months
A proposed class action filed in Washington says the Defense Department ignored years of inspector general warnings before a file-sharing flaw exposed Social Security numbers and other records of more than 3 million people tied to the military. Here is the case, the claims, and the lessons for any organization holding personal data.
For about nine months, a flaw in a Defense Department file-sharing system left unencrypted personnel files open to people who should never have seen them. Now two Marines want the department to answer for it in court.
This case file is based on Federal News Network’s report, with additional detail from Defense News and the court docket.
The breach
The Defense Manpower Data Center (DMDC) keeps records on service members and people connected to the military. In September, it disclosed that on July 16 it had found a vulnerability in a file-sharing system that let a “small number of unauthorized users” reach files containing full names, Social Security numbers, birth dates, contact information and military jobs. According to the lawsuit, the files were exposed for about nine months before anyone noticed. Affected people were not told until late September.
At the time, a Pentagon official told Federal News Network there was no indication anyone’s personal information had been misused. The department offered 12 months of credit monitoring and identity restoration services.
The case
The suit, Edwards and Stampfli v. Department of War, was filed October 20 in the U.S. District Court for the District of Columbia, according to the docket. The plaintiffs are Marines Tristyn Edwards and Morgan Stampfli. They seek to represent everyone affected, more than 3 million people, and are asking for more than $5 million in damages under the Privacy Act of 1974.
Their argument is that the breach was foreseeable. The complaint points to inspector general reports going back to 2021 that flagged weaknesses in the department’s cybersecurity, and to an inspector general report released days after the breach that found the department was not operating at an effective level on 14 of 20 core metrics under the Federal Information Security Modernization Act. The complaint says the department continued to “intentionally and willfully disregard its cybersecurity responsibilities.”
The plaintiffs name the controls they say would have prevented the breach: regular review of accounts, vulnerability scanning, encryption or tokenization of sensitive fields such as Social Security numbers, and routine monitoring of system logs for suspicious activity.
The harm they describe
Both plaintiffs say they have seen multiple fraudulent charges on their financial accounts and a sharp rise in spam calls and emails since the breach. The complaint warns of further misuse, including identity theft, in the months and years ahead.
What happens next
The case is at its very first stage. The court has not ruled on anything, the class has not been certified, and the claims have not been tested. The department’s response to the lawsuit was not reported in the coverage we reviewed.
What this means for your company
Strip away the Pentagon and this is a familiar story: a file-sharing tool, sensitive records sitting unencrypted, warnings on paper that were not acted on, and a long gap before anyone noticed. The four controls the plaintiffs list are within reach for any business. Review who has access to shared folders and remove what is not needed. Scan for vulnerabilities on a schedule. Encrypt or mask Social Security numbers and similar fields rather than storing them in plain files. Send logs somewhere someone actually reviews them. And if an assessment or auditor flags a gap, record who owns the fix and when it will be done, because unresolved findings are exactly what a plaintiff or regulator will ask about later.
Need help finding where sensitive employee or customer records live and closing the gaps an auditor would flag? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
