AXY News Global

AXY News Global · defense

Marines Sue Pentagon Over Defense Manpower Data Center Data Breach

Lawsuit alleges ignored cybersecurity flaws let scammers misuse service members' personal information

By AXY Defense Desk ·

The Pentagon, the Headquarters of the US Department of Defense. Photo was taken from a commercial airliner during the early morning sometime in September 2018.
The Pentagon, the Headquarters of the US Department of Defense. Photo was taken from a commercial airliner during the early morning sometime in September 2018.

Key points

Two Marines have filed a class-action lawsuit against the Pentagon over a data breach at the Defense Manpower Data Center, or DMDC, which they say let scammers obtain and misuse their personal information. The complaint was filed Tuesday in federal court in the District of Columbia by Marine veteran Tristyn Edwards and active-duty Marine Morgan Stampfli. It argues the Defense Department ignored known weaknesses in its systems before the breach happened.

The plaintiffs say the breach has already caused them harm. They allege fraudulent charges on their financial accounts and an increase in spam messages. Those are the kinds of problems that often follow when someone’s personal details end up in criminal hands, and they are the reason the case is being brought as a class action.

A class action is a lawsuit filed on behalf of a larger group of people who have the same complaint. If the court allows the case to proceed as a class action, the outcome could reach well beyond the two named plaintiffs. Every person in the group would be bound by the result, which is why these filings often draw attention from people who never signed up to be part of them.

How a File-Sharing Flaw Exposed Service Members’ Records

The DMDC said in September that it had discovered a vulnerability on July 16 in a file-sharing system. A vulnerability is a weakness in software or a system that an attacker can use to get in where they should not be able to. In this case, the weakness allowed unauthorized users to access unencrypted files containing personal information.

Unencrypted means the files were not scrambled in a way that would make them unreadable to someone without the right key. Anyone who reached them could read them directly. According to the source, the files included full names, Social Security numbers, birth dates and military occupations.

That combination matters. A name, a Social Security number and a date of birth are among the details that banks, lenders and other organisations often use to confirm who someone is. Criminals who hold that set of information can try to open accounts, take over existing ones or pose as the person they are targeting. That is why a breach of this kind can keep causing trouble for years after it is first discovered.

Nine Months Before Anyone Noticed

The lawsuit alleges that the vulnerability exposed millions of files containing information on service members and people affiliated with the military. It says this exposure lasted for approximately nine months before the problem was discovered.

Nine months is a long window. During that time, the files were potentially available to anyone who found the flaw, and the people whose information was inside had no way of knowing their details were at risk. Nobody could change compromised details or watch their accounts for suspicious activity before the damage was done.

For a military family, that window can also overlap with deployments, moves and permanent changes of station, when people are often less focused on their personal finances and more likely to rely on official systems to keep their records safe.

Why Late Notice Became a Central Complaint

The lawsuit also says the DMDC failed to “promptly notify” affected individuals. Some of them, according to the complaint, were informed two or three months after the breach was found. That delay is one of the strongest points in the case, because timing shapes what people can do to protect themselves.

When people learn quickly that their Social Security numbers and birth dates may be exposed, they can place fraud alerts or credit freezes, review bank and credit card statements, and watch for unfamiliar email messages. Each month of delay gives criminals more time to act before the victims even know to look.

The lawsuit makes a forward-looking claim about the harm. It says: “The exposure of Plaintiff and Class members’ PII will cause various types of misuse in the coming months and years, including but not limited to, unauthorized credit card charges, unauthorized access to email accounts, identity theft, and other fraudulent use of their Private Information.” PII is short for personally identifiable information, the term used throughout the complaint for details that can identify a person.

What the Inspector General Found

The complaint relies heavily on reports from the Defense Department’s Office of Inspector General, or OIG. An inspector general is an internal watchdog inside a government agency that reviews its programs and finds problems. The lawsuit says these reports describe failures by both the Defense Department and the DMDC to put adequate cybersecurity controls in place.

In a report published days after the breach, the OIG said that “officials have not taken the necessary actions to demonstrate that they were operating at an effective level for 14 of the 20 [Inspector General Federal Information Security Modernization Act] core metrics.” The Federal Information Security Modernization Act, or FISMA, is the federal law that requires agencies to protect their information systems and to have those protections independently measured. The bracketed text in the quote is the full name of that law, and the core metrics are the benchmarks used to judge whether an agency’s security is working.

The lawsuit argues the Pentagon violated federal privacy laws by failing to protect personal records and to keep its cybersecurity systems compliant. It says this happened despite internal warnings about problems in those systems.

The complaint also lays out what it says should have been done. In the lawsuit’s words: “Had [the Defense Department] properly implemented standard cybersecurity controls — such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive PII like SSNs, and routine monitoring of system logs for suspicious activity — the Data Breach could have been avoided.” Field encryption scrambles specific sensitive fields, such as Social Security numbers, so that they are unreadable without the key. Tokenization replaces the real number with a substitute value that is useless to a thief. Routine log monitoring means reviewing system records for unusual activity so that intrusions are spotted early.

The FBI Cyberattack Question

News of the Defense Department breach emerged alongside reports of a cyberattack targeting FBI personnel files. The source material says the group responsible for the FBI incident has not been linked to the Pentagon breach, so the two cases should not be treated as the same event.

Still, the timing is striking. Two government agencies facing data exposures in the same news cycle will raise questions about whether federal personnel records are being targeted more broadly. Whether the two incidents share any connection is a question the available reporting does not answer.

To address the harm, the department offered affected individuals 12 months of credit monitoring and identity-restoration services. Credit monitoring alerts a person when their credit file changes, such as when a new account is opened in their name. Identity-restoration services help victims clear fraudulent records and recover from identity theft. Twelve months is a fixed period, and the lawsuit’s claims about harm that may unfold in the coming years suggest that many affected people could be dealing with fraud after that offer runs out.

What Comes Next for the Marines’ Class Action

The complaint is the next step in a case that now has to be tested in court. The allegations in the lawsuit have not been proven, and the court will have to decide whether the claims can proceed and whether the case can be certified as a class action. Those are the early tests that will determine how far the case can go.

The central questions are likely to be whether the Pentagon can be held responsible under federal privacy laws for the way it protected records, and whether the notification delay caused harm separate from the breach itself. The OIG reports cited in the complaint will be central to that argument, since they are official government findings rather than the plaintiffs’ own claims.

For the people whose information was in the exposed files, the practical steps are the same ones any breach victim should take: watch financial accounts closely, be cautious with unexpected messages, and use the credit monitoring and identity-restoration services the department has offered. The lawsuit will not stop fraud already in progress, but it will show whether the government is held to account for protecting the records it keeps on service members.

Questions and answers

What is the Pentagon data breach about?

The Defense Manpower Data Center said it found a vulnerability on July 16 in a file-sharing system that let unauthorized users access unencrypted files with personal information, including names, Social Security numbers, birth dates and military occupations.

Who filed the lawsuit over the Defense Manpower Data Center breach?

Marine veteran Tristyn Edwards and active-duty Marine Morgan Stampfli filed the class-action lawsuit Tuesday in federal court in the District of Columbia. They allege fraudulent charges on their financial accounts and an increase in spam messages.

Why does the lawsuit say the Pentagon is at fault?

The lawsuit argues the Pentagon violated federal privacy laws by failing to protect personal records and maintain compliant cybersecurity systems, despite internal warnings. It cites Inspector General reports describing failures in the department’s cybersecurity controls.

Is the Pentagon breach linked to the FBI cyberattack?

The source material says the group responsible for the FBI personnel file cyberattack has not been linked to the Pentagon breach. The two incidents were reported at the same time.

Topics: Pentagon, Defense Manpower Data Center, data breach, US Marines, class action lawsuit, cybersecurity, Social Security numbers

Sources: Military Times

https://axynewsglobal.com/article/marines-sue-pentagon-over-defense-manpower-data-center-data-breach