Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says - Defense News
Two Marines have filed a class-action lawsuit against the Pentagon, alleging negligence in a data breach at the Defense Manpower Data Center that exposed their personal information to scammers.
Marine veteran Tristyn Edwards and active-duty Marine Morgan Stampfli filed the lawsuit in federal court in Washington, D.C., claiming they experienced fraudulent charges on their financial accounts and increased spam messages due to the breach at the Defense Manpower Data Center (DMDC).
The breach involved unencrypted files containing personally identifiable information including full names, Social Security numbers, birth dates, and military occupations.
System Failures
The lawsuit alleges that the Pentagon violated federal privacy laws by failing to protect personal records and maintain compliant cybersecurity systems, despite internal warnings about issues. The complaint cites multiple reports from the Defense Department's Office of Inspector General describing failures to implement adequate cybersecurity controls.
Officials have not taken the necessary actions to demonstrate that they were operating at an effective level for 14 of the 20 [Inspector General Federal Information Security Modernization Act] core metrics.
Delayed Response
The lawsuit also claims the DMDC failed to promptly notify affected individuals, with some being informed two or three months after the breach was discovered. The Pentagon offered affected individuals 12 months of credit monitoring and identity-restoration services.
Had [the Defense Department] properly implemented standard cybersecurity controls — such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive PII like SSNs, and routine monitoring of system logs for suspicious activity — the Data Breach could have been avoided.
The complaint warns that the exposure of personal information will cause various types of misuse in the coming months and years, including unauthorized credit card charges, identity theft, and other fraudulent use of private information.
Related
