21K Soldiers and Civilians Impacted by US Marines Data Breach

The personal information of thousands of Marines, sailors, and civilians has been disclosed in a major data breach emanating from the US Marine Corps Forces Reserve.

 According to the Marine Corps Times, roughly 21,426 people are impacted by the data breach when an unencrypted email containing personally identifiable information (PII) was sent to the wrong email distribution list on Monday morning.

The compromised attachment contained highly sensitive information such as truncated social security numbers, bank details, truncated credit card information, mailing addresses, residential addresses and emergency contact information.

The email was sent within the usmc.mil official unclassified Marine domain, but also to some civilian accounts by the Defense Travel System (DTS).

Maj. Andrew Aranda, spokesman for Marine Forces Reserve said in a command release that “no malicious intent was involved” in this leak, but that they do plan to implement future changes to better safeguard personally identifiable information.

“The Marine Corps takes the protection of individual Marines’ private information and personal data very seriously, and we have steps in place to prevent the accidental or intentional release of such information,” Aranda said.

While it’s great news that the agency will soon be taking steps in the right direction to better secure PII, once sensitive data moves out of the Marine domain, there’s no telling how far it could spread. This confidential information could be used to commit bank or credit fraud, identity fraud, and help criminals engage in phishing schemes.

NNT suggests implementing high priority security controls like those outlined in the NIST 800-171 Special Publication to compliment your organizations existing IT strategy. This specific compliance standard is designed to provide guidance to anyone who handles Controlled Unclassified Information when the CUI is resident in non-federal information systems and organizations, but several of the controls are taken directly from the NIST SP 800-53 compliance standard, almost acting as a streamlined version of NIST 800-53. NIST 800-53 is a comprehensive guide to securing federal information systems.