The 2027 Congress and the Dangerous Data Breach Pileup - CSIS | Center for Strategic and International Studies
The 2027 Congress will address a dangerous pileup of data breaches that have exposed millions of U.S. government personnel, including those in sensitive national security roles.
Unauthorized users accessed a Department of Defense (DOD) human resources database containing Social Security numbers and job details about 2.76 million living personnel and 294,000 deceased individuals. Hackers also broke into an FBI jobs portal, stealing data about thousands of personnel working in highly sensitive roles including counterintelligence and operations against Russia, China, Iran, Hezbollah, and critical infrastructure. Additionally, hackers compromised the Department of Homeland Security's (DHS) personnel files, publishing a searchable database online with the names, phone numbers, and addresses of more than 40,000 DHS agents, including undercover personnel.
These three breaches occurred within a short timeframe, collectively exposing millions of U.S. government personnel to risks of foreign intelligence collection, approaches by nation-states, blackmail, physical targeting by criminal organizations, and cyber threats. As the next Congress determines its priorities, members should seek to understand these incidents and their potentially wide-ranging impacts on national security.
Oversight Steps
Congress should first examine whether the relevant agencies have fully assessed the scope of these incidents. The FBI breach was initially reported to impact only FBI personnel, but the Justice Department later informed select personnel that their data may also have been compromised. The DOD and DHS breaches could similarly contain information on more people than currently understood.
After understanding the scope, Congress should investigate three critical questions: whether systems have been technically secured and recovered; what physical protections are being provided to personnel; and what measures are being taken to address counterintelligence implications.
Physical Protection Concerns
While adversarial nations like China or Russia might not target individual employees with violence, the Iranian government—a known state sponsor of terrorism—could exploit the data to identify and target FBI agents working against its interests. Transnational criminal organizations, particularly cartels, might also use the information to find and physically target personnel working against their activities or to uncover and silence informants.
In the wrong hands, data breaches of this kind could quickly move from an abstract-sounding statistic to an incident of physical violence.
Counterintelligence Implications
These breaches represent a counterintelligence disaster for the United States. Foreign adversaries could use the data to map U.S. government organizational structures, identify personnel working on issues of strategic concern, and target them with approaches or phishing attacks. The data could also be used to build profiles of early-career personnel who might move to more relevant positions in the future.
In the AI era, each data breach can be combined with other datasets and analyzed using AI models to create greater security risks. Congress must consider how this data may still provide value to adversaries years from now and develop comprehensive mitigation strategies.
Related
