Pentagon Sued Over Data Breach Affecting More Than 3 Million People
Two Marines say the Defense Department ignored years of warnings before a file-sharing flaw exposed Social Security numbers and military service records
By AXY Government Desk ·
Key points
- Two Marines, Tristyn Edwards and Morgan Stampfli, sued the Defense Department in federal court in the District of Columbia over a breach at its Defense Manpower Data Center.
- The breach exposed personal information of more than 3 million people with military ties, including full names, dates of birth and Social Security numbers.
- The vulnerability was discovered in July, the data was reachable for nearly nine months, and affected people were not notified until late September.
- The lawsuit alleges violations of the Privacy Act of 1974 and cites inspector general warnings dating back to 2021. These are allegations, not court findings.
Two Marines have sued the Defense Department over a data breach that exposed the personal information of more than 3 million people with ties to the U.S. military. The lawsuit was filed on Tuesday in federal court in the District of Columbia. It says the department violated the Privacy Act of 1974 by failing to safeguard sensitive personal information and by not putting adequate cybersecurity controls in place, even after internal warnings.
The plaintiffs are Tristyn Edwards, an active-duty Marine, and Morgan Stampfli, a Marine veteran. Both say the breach has already caused them trouble. The breach involved the Defense Manpower Data Center, usually called DMDC, which holds personnel information for the department. The Defense Department is the agency that oversees the U.S. armed forces, and it is often called the Pentagon after its headquarters building outside Washington. The complaint itself uses the abbreviation DoD.
How a File-Sharing Flaw Exposed Military Records
The lawsuit traces the breach to a weakness in DMDC’s file-sharing system. A file-sharing system lets people and offices send and store documents so others can see them. When one of these systems has a vulnerability, it can let people reach files they were never supposed to open.
In July, DMDC discovered that vulnerability. It had allowed a “small number of unauthorized users” to access a massive amount of sensitive data. The exposed information included full names, dates of birth, Social Security numbers, contact information, military jobs and other records. The lawsuit says the data was accessible for nearly nine months before the problem was found.
That window is the detail that stands out most. A flaw that stays open for nine months gives anyone who finds it a long time to copy records. The lawsuit does not stop at the discovery in July. It argues the weakness should have been caught and closed long before that, and that the department’s own history shows it had been warned.
The Two-Month Wait Before Affected People Were Told
The department did not notify affected individuals until late September. That came roughly two months after DMDC found the vulnerability in July. For people whose personal data was exposed, the timing matters a great deal.
When people learn quickly that their information has been exposed, they can act. They can place fraud alerts or security freezes with credit bureaus, watch their bank and card statements more closely, and report suspicious activity before a criminal runs up charges. Each week of delay gives thieves more room to move, and it can make the damage harder to undo.
The plaintiffs argue that the breach itself was the core failure, and that the late notice compounded the problem. Their complaint treats the two steps as part of one pattern of neglect rather than as separate mistakes.
Why a Social Security Number Makes This Breach Serious
Not every data leak carries the same risk. A Social Security number is a nine-digit federal identifier that banks, lenders, employers and government agencies use to confirm who a person is. When a Social Security number is combined with a full name and a date of birth, criminals often have enough information to pose as someone else. That is the basic mechanism of identity theft, which is the use of another person’s details to open accounts, borrow money or make purchases.
The records in this breach included that combination. The lawsuit says it included full names, dates of birth and Social Security numbers together with contact information and military job details. Those details can also make scam calls and messages sound convincing, because the caller can refer to a person’s real job, address or history.
The plaintiffs say they have already felt the effects. They describe multiple fraudulent charges on their financial accounts. They also report “drastic” increases in spam calls and emails. A sudden jump in unwanted contact is often a sign that someone has obtained personal details and is selling them or using them to target victims.
The Security Clearance Problem Facing Edwards
Edwards says the harm will not end soon. In the lawsuit, he said the breach will continue to harm him and other affected individuals for years because of what he called the department’s “ineffective data security measures.” He points to identity theft, fraudulent charges and new lines of credit opened in his name without his permission.
New lines of credit can take a long time to clear. An account that a thief opens and then fails to repay can lower a person’s credit score and stay on a credit report for years. That can affect a person’s ability to rent a home, buy a car or qualify for a loan.
Edwards also argues that identity theft could jeopardize his job. He needs to keep a security clearance for his work. A security clearance is an official approval that allows a person to see classified or otherwise sensitive government information. Getting and keeping one usually depends on a background review that looks closely at finances and personal conduct. If accounts are opened in someone’s name without consent, that person may have to explain the problems during a review, and the explanation may not be simple. For Edwards, that is a direct link between a data breach and his career.
Inspector General Warnings Dating Back to 2021
The Privacy Act of 1974 is the main federal law that governs how agencies collect, store and share records about individuals. It requires agencies to keep personal information secure and to limit who can see it. In some cases, the law allows people to sue the government when an agency breaks its rules. The Marines’ complaint is built on that framework.
The lawsuit goes further than the breach. It cites inspector general reports dating back to 2021. Inspectors general are watchdog officials who work inside federal agencies and examine whether programs are run properly, including how well they protect information. The complaint says those reports warned the department about problems with its cybersecurity practices.
The central claim is that the department did not act on those warnings. The complaint argues the Pentagon continued to “intentionally and willfully disregard its cybersecurity responsibilities.” That is a strong accusation. It goes beyond saying the department made mistakes. It says the department knew about the weaknesses and kept going anyway.
The plaintiffs also point to the Federal Information Security Management Act, which sets legal requirements for federal agencies to protect their information systems. They argue the department has shown “persistent, knowing non-compliance” with those requirements. In their view, that pattern led to the kind of harm the Privacy Act is meant to prevent, including embarrassment, inconvenience and unfairness to the people whose records were exposed.
The Controls the Marines Say Could Have Prevented the Breach
The plaintiffs list several basic security steps they say the department should have taken. The first is regular review of accounts, which means checking who has access to a system and removing people who should no longer have it. The second is scanning for vulnerabilities, which is an automated search for weak points before outsiders find them.
The complaint also names encryption or tokenization of sensitive personal information. Encryption scrambles data so that it cannot be read without a key. Tokenization replaces a sensitive number, such as a Social Security number, with a stand-in value that is useless to a thief. Both methods are meant to make stolen files worth much less. The final step they list is routine monitoring of system logs for suspicious activity, which means reviewing the records a system keeps of who accessed what, and when.
The argument is direct. In the plaintiffs’ words, had the department properly put those controls in place, “the data breach could have been avoided.” Whether a court agrees is a separate question. For now, the claim is an allegation in a complaint, not a finding.
What the Lawsuit Asks the Court to Consider
A complaint is the opening document in a lawsuit. It sets out the facts the plaintiffs say are true and the legal grounds for their case. It is not a ruling, and it does not establish that the department broke the law. The court has not decided whether the Pentagon violated the Privacy Act.
The Marines accuse the department of “flagrant disregard for the privacy interests of service members and other military-adjacent individuals.” They also say the department “refused to take steps to implement appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records as required by the Privacy Act.” Those words describe the heart of their case. They say the duty was clear and the department chose not to meet it.
Those claims will have to be tested. The plaintiffs will need to show that the warnings existed, that the department received them, and that the failures caused specific harm to them. The department will have its own response to make in court.
What Comes Next and Why It Matters to Military Families
The next test is whether the case moves forward. Early in a lawsuit, courts often decide whether a complaint has a sound legal basis to continue. If it does, the case moves into the stage where each side can request documents and information from the other. That stage could reveal what the inspector general reports said, how the department responded, and what steps were taken after the breach.
The case also matters beyond the courtroom. The figure of more than 3 million people covers a wide group, including active-duty members, veterans and others whose information sits in DMDC systems. Many of them may not have known their personal data was held in a system that remained open for months. Anyone who received a notice from the department should check their credit reports and bank statements closely, and should treat unexpected calls or messages about their accounts with caution.
For Edwards and Stampfli, the case is about accountability. For the people whose records were exposed, the question is simpler. The lawsuit asks whether the Pentagon will be held responsible for failing to protect them, and whether the next breach can be stopped before it reaches a nine-month window.
Questions and answers
Who is suing the Pentagon over the data breach?
Two Marines are suing the Defense Department: Tristyn Edwards, an active-duty Marine, and Morgan Stampfli, a Marine veteran. The lawsuit was filed in federal court in the District of Columbia.
What information was exposed in the Defense Manpower Data Center breach?
The exposed records included full names, dates of birth, Social Security numbers, contact information, military jobs and other records. The breach affected more than 3 million people with ties to the U.S. military.
Why were people not told about the breach sooner?
The department found the vulnerability in July but did not notify affected individuals until late September. The lawsuit argues the department failed to protect the data and ignored earlier inspector general warnings.
What does the lawsuit say the Pentagon violated?
The lawsuit alleges that the department violated the Privacy Act of 1974 by failing to safeguard sensitive personal information and to put adequate cybersecurity controls in place. These are allegations that the court has not yet decided.
Topics: Pentagon, Defense Manpower Data Center, Defense Department lawsuit, military data breach, Privacy Act of 1974, identity theft, security clearance
Sources: Federal News Network