Pentagon hit with class action over data breach affecting millions of military members

By Mike Scarcella and Raphael Satter

WASHINGTON, Oct 21 (Reuters) - The US Defense Department is facing a class action lawsuit alleging it failed to protect sensitive personally identifiable information from a cyber breach that exposed data belonging to millions of current and former military members.

The lawsuit, filed on Monday in federal court in Washington, said the breach last year at the Defense Department’s Defense Manpower Data Center left Social Security numbers, dates of birth and other military personnel information exposed for months.

The Pentagon showed “flagrant disregard for the privacy interests of servicemembers and other military-adjacent individuals,” the lawsuit said.

The two plaintiffs, a current and a former Marine, aim to represent a class of more than three million US servicemembers. They are seeking damages of more than $5 million.

The Pentagon and lawyers for the plaintiffs did not immediately respond to requests for comment.

The data breach was disclosed last month around the time of the recent hack of the Federal Bureau of Investigation, which compromised Social Security numbers, job information and other sensitive data belonging to thousands of employees.

Reuters reported earlier this month that the bureau had removed an Accenture contractor for allegedly failing to properly update a software platform ahead of the hack.

In the Pentagon lawsuit, the intruders allegedly exploited a vulnerability in a personnel-records file-sharing system, allowing access to unencrypted personal data.

Other federal agencies in recent years have been hit with cyber breaches. In 2022, the US Office of Personnel Management agreed to pay $63 million to resolve a class action lawsuit filed on behalf of millions of US employees.

The case is Tristyn Edwards et al v. US Department of War, US District Court, District of Columbia, No. 1:26-cv-03667.

For plaintiffs: Jason Rathod and Nicholas Migliaccio of Migliaccio & Rathod

For defendant: No appearances yet

Read more:

Friend of suspected FBI data thief says he warned 'crazy' teen not to hack bureau

Accenture contractor removed from FBI following damaging data breach

ShinyHunters hackers say they stole psychiatric and medical records of FBI staff

Hacked FBI data has sensitive information about employees’ intelligence roles