Loading story…
A publicly accessible directory tied to U.S. government contractor CMI Management Inc. exposed more than 70,000 files linked to U.S. military installations and personnel. Reports say the contractor, which provides facility management services to the U.S. Army, left records openly available for months through an open directory listing, allowing access to sensitive material including personnel records, contractor documents, maintenance forms, emails, schematics, and photographs taken inside military bases.
The leak created risks including phishing, impersonation, and intelligence gathering against military facilities and staff. Researcher Arkadeep Roy reportedly alerted CISA in 2024 after the exposure was identified following a tip to Cybernews, but the files remained accessible as recently as March 2026, underscoring how long-lived misconfigurations at defense contractors can leave operationally sensitive government data exposed.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
On May 7-8, 2026, news reports disclosed that CMI Management, a U.S. government contractor supporting the Army, had exposed sensitive data connected to U.S. military installations through a misconfigured public-facing directory.
Despite the 2024 notification, the exposed directory remained accessible for months and was still publicly reachable as of March 2026. The leak reportedly included more than 70,000 files such as schematics, personnel records, maintenance forms, emails, contractor records, and photos from inside military bases.
Security researcher Arkadeep Roy notified CISA in 2024 after identifying an open directory listing exposing sensitive CMI Management files tied to U.S. military installations and personnel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public GitHub repository tied to a contractor supporting the U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) exposed plaintext passwords, access tokens, cloud keys, logs, spreadsheets, and deployment files that could provide access to CISA and Department of Homeland Security internal and cloud systems. Researchers from GitGuardian and Seralys reported that the repository, named **"Private-CISA"**, contained administrative credentials for three AWS GovCloud accounts as well as numerous credentials for internal CISA systems; some of the exposed secrets were verified as valid. The repository was reportedly linked to a Nightwing employee and appears to have been used as an informal working scratchpad rather than a controlled code repository, with commit history indicating GitHub secret-scanning protections had been disabled. After alerts to the contractor reportedly went unanswered, the issue was escalated and the GitHub account was taken offline, but exposed AWS keys were said to remain valid for roughly 48 hours after disclosure. CISA said it is investigating and that it had no indication the credentials were abused, though the incident represents a significant security lapse at the federal agency responsible for civilian cybersecurity.
Jun 29, 2026
Schemata, an AI-powered virtual training platform used by defense customers under active Department of Defense contracts, exposed cross-tenant data through API endpoints that lacked effective authorization checks. Researchers at Strix reported that a low-privilege account could access user listings, organization records, course information, training metadata, and direct AWS-hosted document links belonging to other tenants. The exposed material reportedly included confidential naval maintenance training content, Army field manuals covering explosive ordnance handling and tactical deployment, and service member records containing names, email addresses, enrollment details, and military base affiliations. Researchers said the same authorization failures also affected write-enabled routes, creating the potential for unauthorized modification or deletion of training courses. Strix disclosed the issue privately on **December 2, 2025** and said remediation took roughly 150 days despite repeated follow-ups; Schemata said it patched the exposed endpoints on **May 1, 2026**, found no evidence of third-party exploitation, and began working with cybersecurity consultants and government authorities. The exposure has intensified scrutiny of basic tenant-isolation controls and compliance obligations tied to protecting defense-related data, including **Controlled Unclassified Information** under `DFARS 252.204-7012` and **CMMC** requirements.
Jun 29, 2026
CISA disclosed that a contractor exposed privileged AWS GovCloud keys and other sensitive credentials in a public GitHub repository, triggering an internal response after the leak was reported in May. According to the agency’s forensic and post-mortem findings, the exposure was first flagged by a GitGuardian researcher and relayed through journalist Brian Krebs after the contractor allegedly did not respond to the initial warning. CISA said it took the repository and the associated developer environment offline, revoked the individual’s access, and rotated the exposed secrets. The agency said its review of repository activity and logs found no evidence that the leaked credentials were used outside CISA and that no customer or mission data was exposed. The incident nevertheless exposed gaps in CISA’s own readiness, including the absence of a preexisting incident response playbook for this type of event and unclear reporting channels for outside researchers. In response, CISA said it is strengthening protections for sensitive material, improving secrets management and rotation, monitoring uploads to public repositories through EDR, simplifying vulnerability reporting, and developing formal playbooks for GitHub-related and similar incidents.
Jul 16, 2026