The vulnerable server was hosted in the government’s Microsoft Azure cloud for DoD customers. It was used to share confidential but unclassified government data.

what is known

The issue was discovered by information security researcher Anurag Sen, who briefed TechCrunch journalists about the discovery so they could help alert the US government to the leak. According to the data, the server was first seen publicly on February 8, 2023. It’s not entirely clear why this happens. Most likely, it was due to someone’s carelessness and misconfiguration.

• The server remained unencrypted contains approximately three terabytes of internal pagesmany included the US Special Operations Command (USSOCOM).
• The absence of a password allowed anyone to access sensitive data knowing only the server’s IP address.
• Source says the server is full years by domestic military mail.
• Some emails contained confidential personnel information.
• Vodno’s files revealed a completed SF-86 form filled out by federal employees seeking access to classified information. Journalists explain that these surveys contain important personal and health data that are necessary to check before people are allowed to work with confidential data.
• In addition, the surveys contain biographical information about people who have access to confidential information, which can be valuable information for foreign special services.

TechCrunch notes that the editors did not find confidential information among the letters.

After reporters contacted USSOCOM, the server was properly secured and disappeared from public access last Monday. The investigation into this incident is ongoing, but it is not yet known whether anyone has managed to discover this server and the data stored on it. The agency does not comment on this.