Two Marines are suing the Defense Department over a breach of the Defense Manpower Data Center’s information system that exposed the personal information belonging to more than 3 million people with ties to the U.S. military.
The lawsuit, filed Tuesday in federal court in the District of Columbia, alleges that the department violated the Privacy Act of 1974 by failing to safeguard sensitive personal information and adequate cybersecurity controls despite internal warnings.
In July, the DMDC discovered a vulnerability in its file sharing system that allowed a “small number of unauthorized users” to access a massive swath of sensitive data, including full names, dates of birth, Social Security numbers, contact information, military jobs and other records, for nearly nine months. The department didn’t notify affected individuals of the breach until late September.
The plaintiffs, Active-duty Marine Tristyn Edwards and Marine veteran Morgan Stampfli, said the Pentagon exhibited “flagrant disregard for the privacy interests of service members and other military-adjacent individuals” and “refused to take steps to implement appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records as required by the Privacy Act.”
The complaint cites inspector general reports dating back to 2021 that warned the department about problems with its cybersecurity practices but continued to “intentionally and willfully disregard its cybersecurity responsibilities.”
“Had DoD properly implemented standard cybersecurity controls — such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive [personal information] and routine monitoring of system logs for suspicious activity — the data breach could have been avoided,” the plaintiffs argue.
“The DoD’s history of persistent, knowing non-compliance with [Federal Information Security Management Act’s] legal requirements ultimately resulted in the substantial harm, embarrassment, inconvenience or unfairness that [the Privacy Act] is designed to protect against,” they added.
The plaintiffs said they experienced multiple fraudulent charges on their financial accounts and “drastic” increases in spam calls and emails.
Edwards said the data breach will continue to harm him and other affected individuals for years as a result of the department’s “ineffective data security measures,” including identity theft, fraudulent charges and new lines of credit opened without their permission.
In addition, Edwards argues that identity theft could jeopardize his employment because he needs to maintain a security clearance for his work.
Stampfli said he experienced an unauthorized online purchase on his Navy Federal Credit Union debit card, and his email address was registered for a large number of newsletters and mailing lists.
When the Defense Department disclosed the incident in September, a Pentagon official told Federal News Network that there is “no indication that anyone’s personal information has been misused.”
The plaintiffs seek to represent more than three million impacted individuals and are seeking more than $5 million in damages.
The FBI suffered a major data breach around the same time the Defense Department disclosed its security breach.
If you would like to contact this reporter about recent changes in the federal government, please email anastasia.obis@federalnewsnetwork.com or reach out on Signal at (301) 830-2747.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.