The Nine-Month Blind Spot: How a Pentagon File-Sharing Exposure Put 3 Million Service Members at Risk
A class-action lawsuit filed on October 20 in the U.S. District Court for the District of Columbia has pulled back the curtain on a nine-month-long data breach that exposed the personally identifiable information of more than three million current and former military service members, family members, and Pentagon staff. The breach, traced to a vulnerable file-sharing system operated by the Defense Manpower Data Center (DMDC), began in October 2025 yet went “completely unnoticed” until July 2026 — a blind spot that plaintiffs’ counsel describes as “a startling lack of cybersecurity controls and system monitoring” at the very agency that helps set federal cybersecurity standards.
A Class Action Filed Against the Pentagon
The complaint, brought on behalf of a nationwide class under the Privacy Act of 1974, names two plaintiffs: Tristyn Edwards, an active-duty Marine, and Morgan Stampfli, a former Marine who separated in 2021. Both allege they have already suffered fraud directly traceable to the breach. Edwards reports receiving emails stating his personal data was available on the dark web, a marked increase in spam calls, and multiple fraudulent debit-card charges totaling more than $300 — all before the DMDC’s “drastically delayed notice.” Stampfli experienced an unauthorized online purchase of more than $270 charged to his Navy Federal Credit Union debit card just days after receiving the breach notification; the order contained his correct personal and billing information.
The DMDC, which as of 2024 held more than 60 million records including social security numbers, full names, contact information, and occupational specialties, identified the vulnerability in its file-sharing system in July 2026. The agency’s notice confirmed the system was “immediately updated to patch the vulnerability,” but affected individuals were not notified until late September or early October 2026 — a nine-month gap between initial unauthorized access and notification. The complaint alleges the DoD has “failed to offer any assurance that personal data or relevant copies have been recovered or destroyed.”
Crucially, Edwards’ security clearance makes common mitigations such as freezing his credit unavailable, while the reputational damage from potential identity theft could affect his employment. Stampfli reported a surge in spam emails following the breach notification. The filing points to commentators’ assessment that this “wasn’t the result of sophisticated cyberattack. It was a failure of fundamental security controls.”
A Nation's Own Identity Infrastructure Failed
The DMDC breach arrives alongside new telemetry showing that identity infrastructure remains the primary target for ransomware actors — and that post-incident exposure reduction lags far behind incident closure. Semperis’ 2026 Ransomware Risk Report, published October 14, surveyed organizations victimized by ransomware in the prior 12 months across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada, and Australia. The findings are stark: 87% of ransomware attacks targeted identity systems such as Active Directory, Entra ID, and Okta, yet only about half of companies maintain dedicated identity backups, automated identity recovery solutions, or identity-specific crisis response procedures. Sixty percent of disaster-recovery plans lack procedures for identity-system recovery entirely.
“Identity is the coin of the realm,” said Chris Inglis, the first U.S. National Cyber Director and a Semperis Strategic Advisor. “If an attacker can steal an identity, they’re off to the races. Insider threats are not always a literal insider… Often, it’s an internal person acting on an external attacker’s behalf to abuse an insider’s privileges.” The report also found that 40% of attacks involved psychological or physical threats against staff, with 53% of those threats carried through — including swatting (24%) and victims or families hiring personal security (24%).
Meanwhile, Black Kite’s 2026 Ransomware Report, tracking 7,551 publicly disclosed victims between April 2025 and March 2026, documented a 24.9% year-over-year increase and a 60% acceleration in second-half volume. The second half alone produced 4,647 victims, holding above 700 per month from October through March. Qilin alone claimed 1,358 victims — a 443% jump — accounting for roughly one in five to six victims globally. The threat actor ecosystem expanded to 146 active groups by June 2026, more than double the 61 counted in 2023.
Ransomware Sets A New Pace After the Incident
The data also reveals a disturbing pattern: 43.5% of victims still carried a CVSS 9.0 or higher vulnerability when Black Kite rescanned them after their incidents closed, and 30.8% still carried a Known Exploited Vulnerability (KEV). Stealer-log exposure on rescans came back 175% higher, and the average Ransomware Susceptibility Index (RSI) rose from 0.557 to 0.616. “Recovering from an incident and reducing the exposure that caused it are not the same project,” the report warns, “and treating them as one is how the same organization ends up victimized twice.”
This gap is exactly what the DMDC case illustrates at national scale. The vulnerability existed for nine months in a system holding 60+ million sensitive records. When discovered, the patch was applied, but the exposure window had already allowed mass exfiltration of identity data — the very “coin of the realm” that Semperis identifies as the primary ransomware target. The same dynamic plays out in the private sector: Ransom-DB recorded 271 confirmed leak-site publications in the first week of October 2026 alone, a 33.5% week-over-week surge, with The_Gentlemen (41 victims), Storm (29), NightSpire (22), and Qilin (21) leading the pack. United States entities absorbed 48.3% of total intrusions.
What This Means For Every Organization
The convergence is clear: identity systems are the common thread connecting a nine-month government blind spot to a global ransomware tempo that now averages more than 700 disclosed victims per month. The Semperis report found that nearly 70% of victims were targeted multiple times, and 31% made multiple ransom payments. Only 50% of organizations maintain dedicated identity backups; less than half automate identity-system recovery.
For the Pentagon, the breach has already triggered a class action under the Privacy Act and congressional scrutiny. The DoD’s disclosure coincided with reports that a cybercriminal group claimed to have stolen personal data of thousands of FBI agents — two of the U.S. government’s top security bodies compromised in the same window. As the ICLG analysis notes, “that two of the US government’s top security and defence bodies have found themselves victims of data breaches will doubtlessly raise serious questions about the adequacy of the country’s cybersecurity safeguards.”
The lesson for every enterprise is the same one the ransomware data teaches: closing the ticket is not closing the exposure. Organizations must treat post-incident recovery as a 90-day external exposure review — rescan for stealer logs, KEV exposure, and critical patch vulnerabilities at 30, 60, and 90 days. Patch prioritization must weight known exploitation and severity, not internal change-management calendars. And third-party risk programs must inventory connected applications and OAuth tokens alongside standard vendor questionnaires, because 2026’s most damaging incidents moved through delegated SaaS trust, not through a vendor’s own perimeter.
As Chris Inglis put it: “An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in.” The DMDC breach proves that when identity infrastructure fails — even at the agency setting the standards — the cost of resisting has already been paid by the millions whose data was never supposed to be exposed.