两名海军陆战队员周二向五角大楼提起集体诉讼，指控国防人力数据中心（DMDC）发生数据泄露，导致诈骗者获取并利用了他们的个人身份信息（PII）。
A pair of Marines filed a class-action lawsuit Tuesday against the Pentagon over a data breach at the Defense Manpower Data Center, or DMDC, arguing it allowed scammers to obtain and use their personally identifiable information, or PII.
根据在哥伦比亚特区联邦法院提交的诉状，退伍海军陆战队员特里斯汀·爱德华兹和现役海军陆战队员摩根·斯坦普夫利指称，他们因该泄露事件遭遇了金融账户上的欺诈性收费，并收到更多垃圾信息。
In the complaint filed in federal court in the District of Columbia, Marine veteran Tristyn Edwards and active-duty Marine Morgan Stampfli allege that they experienced fraudulent charges on their financial accounts and an increase in spam messages because of the breach.
9月，国防人力数据中心表示，该中心于7月16日在一个文件共享系统中发现了一个漏洞，该漏洞允许未经授权的用户访问包含个人信息的未加密文件，包括全名、社会安全号码、出生日期和军事职业。
In September, the DMDC said it had discovered a vulnerability on July 16 in a file-sharing system that allowed unauthorized users to access unencrypted files containing personal information, including full names, Social Security numbers, birth dates and military occupations.
诉状称，该漏洞导致数百万份包含现役军人及军队相关人员信息的文件暴露，在被发现前持续了约九个月。
According to the lawsuit, the vulnerability exposed millions of files containing information on service members and people affiliated with the military for approximately nine months before it was discovered.
诉状还指控，国防人力数据中心未能“及时通知”受影响个人，其中一些人在泄露被发现后两三个月才获告知。
The lawsuit also alleges that the DMDC failed to “promptly notify” affected individuals, some of whom were informed two or three months after the breach was found.
诉状称：“原告及集体成员的个人身份信息暴露将在未来数月和数年内导致各类滥用，包括但不限于未经授权的信用卡收费、未经授权的电子邮件账户访问、身份盗窃及其私人信息的其他欺诈性使用。”
“The exposure of Plaintiff and Class members’ PII will cause various types of misuse in the coming months and years, including but not limited to, unauthorized credit card charges, unauthorized access to email accounts, identity theft, and other fraudulent use of their Private Information,” the lawsuit says.
诉状主张，尽管内部曾就其系统存在问题发出警告，五角大楼未能保护个人记录、维护合规的网络安全系统，违反了联邦隐私法。
The lawsuit argues that the Pentagon violated federal privacy laws by failing to protect personal records and maintain compliant cybersecurity systems, despite internal warnings about issues in its systems.
诉状引用了国防部监察长办公室的多份报告，描述了该部门和国防人力数据中心均未能实施足够的网络安全控制措施。
The complaint cites multiple reports from the Defense Department’s Office of Inspector General describing failures by both the department and the DMDC to implement adequate cybersecurity controls.
在一份泄露事件发生数天后发布的报告中，监察长办公室表示，“在20项《监察长联邦信息安全管理现代化法案》核心指标中，有14项指标上，官员们尚未采取必要行动来证明他们是在有效水平上运作的。”国防部泄露事件的消息与有关联邦调查局人员档案遭到网络攻击的报道同时出现。然而，尚不清楚对联邦调查局事件负责的组织是否与五角大楼泄露事件有关联。国防部向受影响个人提供了12个月的信用监控和身份恢复服务。
In a report published days after the breach, the OIG said that “officials have not taken the necessary actions to demonstrate that they were operating at an effective level for 14 of the 20 [Inspector General Federal Information Security Modernization Act] core metrics.”News of the Defense Department breach emerged alongside reports of a cyberattack targeting FBI personnel files. However, the group responsible for the FBI incident has not been linked to the Pentagon breach. The department offered affected individuals 12 months of credit monitoring and identity-restoration services.
诉讼称：“如果（国防部）妥善实施了标准的网络安全控制措施——例如定期审查账户、扫描漏洞、对敏感个人身份信息（如社会安全号码）进行字段加密或令牌化，以及例行监控系统日志以发现可疑活动——本可避免此次数据泄露。”
“Had [the Defense Department] properly implemented standard cybersecurity controls — such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive PII like SSNs, and routine monitoring of system logs for suspicious activity — the Data Breach could have been avoided,” the lawsuit says.