"A flagrant disregard for the privacy interests of servicemembers and other military-adjacent individuals," the plaintiffs wrote in a filing that crystallizes their case against the U.S. Defense Department.
Plaintiffs, scope and damages sought
Filed on Monday, the class action names two plaintiffs — a current Marine and a former Marine — who say they represent more than 3 million servicemembers. The suit seeks damages of more than $5 million, according to the filing cited in reporting on the case.
The complaint frames the legal action as a broad, representative claim on behalf of current and former military personnel and others it describes as "military-adjacent," alleging systemic exposure of sensitive information over an extended period.
The breach at the Defense Manpower Data Center
The underlying incident, the suit says, was last year’s breach of the Defense Department’s Defense Manpower Data Center. According to the complaint reported on, hackers exploited a vulnerability in a records file‑sharing system, which "enabled them to access unencrypted personal information."
The filing alleges that the compromised information included dates of birth, Social Security numbers, and other sensitive personal data, and that this exposure persisted for months.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAllegations of negligence and privacy harm
The lawsuit charges the Defense Department with failing to protect personally identifiable information, stating that the department showed a "flagrant disregard for the privacy interests of servicemembers and other military-adjacent individuals." That phrase, lifted verbatim from the filing, frames the plaintiffs’ assertion that the department’s practices fell below what the suit deems reasonable privacy protections.
By focusing on unencrypted records and a file‑sharing vulnerability, the complaint draws a direct line between an exploitable system weakness and long-running access to highly sensitive data, including Social Security numbers and dates of birth.
What this means for servicemembers, the Defense Department, and hackers
- Servicemembers and military-adjacent individuals: The plaintiffs highlight exposure of dates of birth and Social Security numbers; affected people will likely watch the litigation closely and monitor for any notices or remedies tied to the suit.
- The Defense Department and the Defense Manpower Data Center: The filing places legal and reputational pressure on the department to explain how a file‑sharing vulnerability allowed months-long access to unencrypted personal information and to address any remaining security gaps.
- Hackers and misuse risks: The complaint notes that the breach enabled access to unencrypted personal data for an extended period, a condition that, according to the filing, increases the potential for misuse of the exposed information.
Legal framing and immediate stakes
The class action anchors its case in the scale of the exposure — more than 3 million people — and quantifies near-term damages sought at more than $5 million. Those figures set a baseline for how the plaintiffs and the court will measure harm and potential compensation, while also signaling the administrative and legal resources the department may need to commit in response.
By naming a specific breached system, the Defense Manpower Data Center, and detailing the kinds of data allegedly exposed, the complaint narrows the dispute to concrete technical and procedural failures rather than abstract privacy concerns.
Conclusion
The filing turns last year’s breach into a formal legal challenge that ties an exploited file‑sharing vulnerability to the prolonged exposure of unencrypted personal information, including dates of birth and Social Security numbers. With more than 3 million servicemembers identified as potential class members and damages sought north of $5 million, the case places the Defense Department under scrutiny over both its technical safeguards and its responsibility to those whose data it holds.
As the suit moves forward, it will test how the department responds to allegations about the vulnerability, the extent of the exposure, and the remedies the plaintiffs seek.
