Follow Beinsure
Two US Marines have filed a lawsuit against the Department of Defense over a cybersecurity breach that exposed sensitive personal information belonging to more than 3 mn service members and other individuals connected to the military.
The lawsuit, filed in the US District Court for the District of Columbia, alleges that the Pentagon violated the Privacy Act of 1974 by failing to protect personal records and implement adequate cybersecurity safeguards despite repeated internal warnings.
- Two Marines filed a federal lawsuit against the US Defense Department after a breach of the Defense Manpower Data Center exposed personal information belonging to more than 3 mn people.
- The plaintiffs allege that the Pentagon ignored cybersecurity warnings dating back to 2021 and failed to implement safeguards required under the Privacy Act of 1974.
- The proposed class action seeks more than $5 mn in damages, with plaintiffs reporting fraudulent financial transactions, increased spam and potential identity theft risks.
The plaintiffs, active-duty Marine Tristyn Edwards and Marine veteran Morgan Stampfli, are seeking to represent more than 3 mn individuals affected by the breach and are requesting damages exceeding $5 mn.
The case concerns a security vulnerability in the Defense Manpower Data Center (DMDC), which maintains personnel information associated with the US military.
Pentagon data breach exposed sensitive records for nearly nine months
The Defense Department discovered the vulnerability in July 2026, finding that a weakness in the DMDC’s file-sharing system had allowed a “small number of unauthorized users” to access sensitive records over a period of nearly nine months.
The exposed information included full names, dates of birth, Social Security numbers, contact details, military job information and other personnel records.
Affected individuals were not notified until late September, approximately two months after the department identified the vulnerability.
The lawsuit argues that the security failure exposed millions of people to potential identity theft and financial fraud, with consequences that could persist for years.
The plaintiffs accused the department of showing “flagrant disregard for the privacy interests of service members and other military-adjacent individuals”.
They also alleged that the Pentagon had “refused to take steps to implement appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records as required by the Privacy Act.”
Lawsuit alleges Pentagon ignored years of cybersecurity warnings
The complaint cites Defense Department inspector general reports dating back to 2021 that identified weaknesses in the agency’s cybersecurity practices.
According to the plaintiffs, the Pentagon continued to “intentionally and willfully disregard its cybersecurity responsibilities” despite receiving warnings about deficiencies in its security controls.
The lawsuit identifies several measures that the plaintiffs argue could have prevented the breach, including regular account reviews, vulnerability scanning, encryption or tokenization of sensitive personal information, and continuous monitoring of system activity.
The plaintiffs also allege persistent noncompliance with cybersecurity obligations under the Federal Information Security Management Act (FISMA).
Had DoD properly implemented standard cybersecurity controls – such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive [personal information] and routine monitoring of system logs for suspicious activity – the data breach could have been avoided.
They argue that the department’s alleged failure to meet those requirements resulted in harm of the kind the Privacy Act was designed to prevent, including financial losses, embarrassment and inconvenience.
These assertions are allegations contained in the lawsuit, rather than findings by the court.
Marines report fraudulent transactions and identity theft concerns
Edwards and Stampfli said they experienced unauthorized financial activity and substantial increases in unwanted communications following the breach.
Both plaintiffs reported fraudulent charges on their financial accounts, along with significant increases in spam telephone calls and emails.
Stampfli said an unauthorized online purchase had been made using his Navy Federal Credit Union debit card. He also reported that his email address had been registered for numerous newsletters and mailing lists without his permission.
Edwards argued that the exposure of sensitive personal information could continue affecting him and other victims for years.
He identified identity theft, unauthorized credit accounts and fraudulent financial transactions as potential long-term consequences of the department’s allegedly inadequate security practices.
Edwards also raised concerns about his military employment, arguing that identity theft could jeopardize his ability to maintain the security clearance required for his position.
The plaintiffs contend that the breach created risks extending beyond immediate financial losses because the exposed records contained information that could be misused in subsequent fraudulent activity.
Defense Department previously reported no evidence of data misuse
When the Pentagon disclosed the incident in September, a Defense Department official told Federal News Network that there was “no indication that anyone’s personal information has been misused”. That statement contrasts with the allegations subsequently raised by Edwards and Stampfli, who reported unauthorized financial transactions and other suspicious activity.
The complaint seeks damages exceeding $5 mn on behalf of a proposed class representing more than 3 mn affected individuals.
The litigation will require consideration of the department’s obligations under the Privacy Act, the cybersecurity controls in place before the incident and the alleged consequences for individuals whose information was exposed.
The DMDC incident was disclosed around the same period as a separate major cybersecurity breach involving the Federal Bureau of Investigation.
The lawsuit against the Defense Department now places the handling of military personnel information and the adequacy of federal cybersecurity safeguards under judicial scrutiny, with the plaintiffs alleging that years of unaddressed security weaknesses contributed to the exposure of millions of sensitive records.
