Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says

A pair of Marines filed a class-action lawsuit Tuesday against the Pentagon over a data breach at the Defense Manpower Data Center, or DMDC, arguing it allowed scammers to obtain and use their personally identifiable information, or PII.

In the complaint filed in federal court in the District of Columbia, Marine veteran Tristyn Edwards and active-duty Marine Morgan Stampfli allege that they experienced fraudulent charges on their financial accounts and an increase in spam messages because of the breach.

In September, the DMDC said it had discovered a vulnerability on July 16 in a file-sharing system that allowed unauthorized users to access unencrypted files containing personal information, including full names, Social Security numbers, birth dates and military occupations.

According to the lawsuit, the vulnerability exposed millions of files containing information on service members and people affiliated with the military for approximately nine months before it was discovered.

The lawsuit also alleges that the DMDC failed to “promptly notify” affected individuals, some of whom were informed two or three months after the breach was found.

“The exposure of Plaintiff and Class members’ PII will cause various types of misuse in the coming months and years, including but not limited to, unauthorized credit card charges, unauthorized access to email accounts, identity theft, and other fraudulent use of their Private Information,” the lawsuit says.

The lawsuit argues that the Pentagon violated federal privacy laws by failing to protect personal records and maintain compliant cybersecurity systems, despite internal warnings about issues in its systems.

The complaint cites multiple reports from the Defense Department’s Office of Inspector General describing failures by both the department and the DMDC to implement adequate cybersecurity controls.

In a report published days after the breach, the OIG said that “officials have not taken the necessary actions to demonstrate that they were operating at an effective level for 14 of the 20 [Inspector General Federal Information Security Modernization Act] core metrics.”

News of the Defense Department breach emerged alongside reports of a cyberattack targeting FBI personnel files. However, the group responsible for the FBI incident has not been linked to the Pentagon breach. The department offered affected individuals 12 months of credit monitoring and identity-restoration services.

“Had [the Defense Department] properly implemented standard cybersecurity controls — such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive PII like SSNs, and routine monitoring of system logs for suspicious activity — the Data Breach could have been avoided,” the lawsuit says.