Marines Sue Defense Department for Neglecting Cybersecurity Vulnerabilities That Led to Massive Data Breach

Summary

Two U.S. Marines have filed a class-action lawsuit against the Pentagon following a significant data breach at the Defense Manpower Data Center (DMDC), claiming that the department's negligence allowed scammers to access and exploit their personal information. The breach, discovered on July 16, involved a vulnerability in a file-sharing system that exposed unencrypted files containing sensitive data — including Social Security numbers, birth dates, and military occupations — for approximately nine months before detection. The lawsuit alleges multiple failures by the Pentagon, including not implementing adequate cybersecurity controls despite repeated internal warnings from the Defense Department's Office of Inspector General, and failing to promptly notify affected individuals, with some learning of the breach two to three months after its discovery. The plaintiffs argue that the exposed personally identifiable information has already resulted in fraudulent financial charges and increased spam activity, with further risks of identity theft and unauthorized account access expected in the coming years. As a response, the Defense Department offered affected individuals 12 months of credit monitoring and identity-restoration services, which the lawsuit implies is insufficient given the scale and preventability of the breach.