Loading story…
Federal agencies are increasingly transitioning from paper-based to digital processes to improve efficiency and reduce costs, but this shift introduces significant data privacy and security challenges. Sensitive information, once protected by physical controls, is now at risk of exposure through outdated digital documents, email transmissions, and accidental disclosures by employees. The persistence of static documents and hybrid workflows further complicates efforts to secure sensitive data, leaving organizations vulnerable to both insider threats and external attacks.
A recent Government Accountability Office (GAO) report highlights that the Department of Defense (DoD) is not adequately training its personnel or issuing sufficient guidance to prevent the leakage of sensitive information online. Social media activity by military members, their families, and even official press releases have been identified as sources of operationally sensitive data, which could be exploited for blackmail or to disrupt military operations. The GAO's findings underscore the broader risks associated with digital information management in government, emphasizing the need for robust privacy and security measures as agencies modernize their workflows.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
A report published by Security Boulevard highlighted data privacy risks associated with paperless government operations. The reference does not describe a discrete breach or remediation event beyond the publication of this analysis.
A watchdog report found that the Pentagon and U.S. soldiers had allowed too much sensitive information to be exposed through social networks. The reference indicates this finding was publicly reported on the article's publication date.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Department of Government Efficiency (DOGE), a federal agency reportedly created by Elon Musk, has come under intense scrutiny for its handling of sensitive personal data belonging to millions of Americans. According to a report by the Senate Homeland Security and Government Affairs Committee Democrats, DOGE has been bypassing established cybersecurity protections at three major federal agencies: the Social Security Administration (SSA), the General Services Administration (GSA), and the Office of Personnel Management (OPM). The committee's findings are based on staff visits, whistleblower disclosures, legal filings, and media reports, all of which point to significant lapses in data security and privacy compliance by DOGE personnel. One particularly alarming incident involved DOGE uploading the Numident database—a file containing highly sensitive personal information—into an environment lacking additional safeguards, which an internal SSA risk review estimated carried a 35% to 65% chance of a data breach with catastrophic consequences. Whistleblowers further alleged that DOGE staff, including Edward Coristine, had the ability to move sensitive SSA data into unmonitored cloud environments, raising the risk of unauthorized access or exfiltration. The Senate report also highlighted that DOGE teams were sometimes denied access to agency offices due to security concerns, and that DOGE personnel had not completed the same cybersecurity training required of other federal employees. In response to these findings, the committee urged federal agencies to revoke DOGE's access to sensitive information until the department demonstrates compliance with privacy laws and cybersecurity best practices. The report has sparked widespread concern about the potential for large-scale data breaches and the misuse of Americans' personal information. The situation is further complicated by the broader context of increasing government surveillance and the aggregation of disparate data streams, as noted by security experts. The risks posed by DOGE's practices are seen as distinct from those of corporate surveillance, with the potential for government misuse of personal data being particularly acute in a techno-authoritarian environment. The revelations have prompted calls for greater oversight, transparency, and accountability in how federal agencies and their contractors handle sensitive data. Lawmakers and privacy advocates are demanding immediate action to mitigate the risks and prevent future incidents. The controversy underscores the critical importance of robust cybersecurity protocols and strict adherence to privacy regulations in all government operations involving personal data. The ongoing investigation and public debate are likely to shape future policy and enforcement actions regarding federal data security. The case also serves as a cautionary tale for other agencies and private sector partners about the dangers of circumventing established cybersecurity safeguards. As the story develops, the focus remains on ensuring that Americans' personal information is protected from both internal and external threats. The incident has also reignited discussions about the balance between efficiency, innovation, and security in government technology initiatives. Ultimately, the DOGE controversy highlights the urgent need for comprehensive reforms to safeguard the privacy and security of citizens' data in the digital age.
Jun 29, 2026
Unauthorized users exploited a vulnerability in the Defense Manpower Data Center's file-sharing system, accessing unencrypted personnel files from about October 2025 until the flaw was detected on July 16, 2026. The breach may affect roughly 4 million current and former Department of Defense personnel. Exposed information reportedly includes names, dates of birth, contact and demographic data, unencrypted Social Security numbers, and in some cases military occupational specialty or equivalent role codes. DMDC remediated the vulnerability and restored the affected system, detecting and containing the intrusion in July before notifying individuals on September 18. It offered 12 months of IDX credit-monitoring and identity-restoration services; no malicious use had been reported at publication. The incident has not been attributed, and the exploited vulnerability has not been disclosed, but the combination of identity data and military-role information creates substantial identity-fraud and counterintelligence risk, potentially enabling adversaries to identify and target service members, veterans, and their families.
Oct 2, 2026The U.S. Department of Health and Human Services (HHS) has not implemented 82 high-risk cybersecurity and IT management recommendations from the Government Accountability Office (GAO). These include critical issues such as event logging, digitized record handling, and IoT device inventory. The lack of action increases risks to sensitive health data and national security, according to the GAO report released on September 12, 2025.
Jun 29, 2026