For Two Weeks, Confidential Emails From the US Military Were Made Publicly Accessible

An investigation is underway by the Department of Defense and Microsoft regarding an insecure server that resulted in the exposure of emails and data from the U.S. Special Operations Command (USSOCOM). The information compromised was deemed sensitive but unclassified.

The server that was compromised contained an internal mailbox system, which stored approximately three terabytes of military emails, including many related to the U.S. Special Operations Command (USSOCOM). It is the military unit responsible for carrying out special military operations.

Due to a misconfiguration, the server was left without a password, resulting in unrestricted access to the sensitive mailbox data through a web browser. This allowed anyone with knowledge of the server’s IP address to access the information without any additional authentication.

The exposed server was discovered by Anurag Sen, a reputable security researcher who is known for identifying instances of inadvertently published sensitive data online. Sen discovered the server and provided detailed information about the incident.

In addition to containing a large volume of internal military emails dating back several years, the compromised server also included a completed SF-86 questionnaire. These questionnaires are typically filled out by federal employees seeking a security clearance and contain highly confidential personal and health information.

According to Ken McGraw, a spokesperson for USSOCOM, an investigation into the incident began on Monday, and as of Tuesday, they can confirm that no one had hacked into the information systems of the U.S. Special Operations Command.

According to Sen, “I couldn’t confirm what was the reason, only a DoD internal investigation can tell us more about details. But as from my past experience, it’s likely the result of misconfiguration done by human error.”

Inadvertently exposing internal data to the internet is not an uncommon occurrence for large organizations. However, given that this incident involves a Department of Defense email server, US officials are likely to be concerned.