Public Sector 
The Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense (DoD) framework made to ensure organizations handling federal information maintain adequate cybersecurity controls. While CMMC
Federal agencies are facing a critical reckoning with cybersecurity. In the past year alone, high-profile breaches have exposed millions of Americans’ personal data, compromised sensitive intelligence networks and revealed significant gaps in access control practices across some of the government’s most trusted institutions.
From the Pentagon’s sprawling personnel database to the FBI’s jobs portal to the TSA’s internal systems, these incidents share a common thread: inadequate identity and access management controls. As adversaries grow more sophisticated in exploiting credentials and access privileges, federal agencies must reassess how they protect their systems and the sensitive information they safeguard.
Pentagon Human Resources System Breach
A recent breach of the Department of Defense (DoD) human resources database exposed Personally Identifiable Information (PII) of millions of military personnel and their relatives, including their Social Security numbers and job details.
What Happened
Unauthorized users accessed sensitive records between October 2025 and July 16, 2026, when the Defense Manpower Data Center (DMDC) discovered a vulnerability in its file-sharing system. The DMDC maintains personnel information used across the military and other government agencies, and the breach affected roughly 3 million people. A Pentagon official confirmed that 2.76 million “living individuals” and 294,000 “deceased individuals” have been affected by the breach.
The accessed files contained unencrypted PII, including Social Security numbers and, in some cases, names, birth dates, contact information and military occupational specialties.
After discovering the security vulnerability, DMDC immediately initiated privacy and cybersecurity incident response actions, including patching the flaw and restoring the system. Affected individuals are being offered a year of credit monitoring and identity-restoration services.
While credit monitoring services can help the affected individuals from a personal exposure perspective, this breach also becomes a potential national security risk. With PII and military occupation linked together, US adversaries or other bad actors can potentially monitor and exploit service member movements around the world. This breach highlights that, in today’s environment, Privileged Access Management (PAM) should no longer be limited to IT, developers and engineers. It should extend to anyone with access to sensitive data, regardless of their agency or department.
FBI Jobs Portal Breach
The Federal Bureau of Investigation (FBI) is investigating a cyberattack on its FBIJobs.gov jobs portal after the cybercrime group ShinyHunters said it hacked the system and stole a vast amount of sensitive data from the bureau. ShinyHunters shared a sample of the compromised data with several news outlets, which contained PII on 5,000 FBI employees, including addresses, phone numbers, dates of birth and, in some cases, details on spouses. Many of the employees whose data was stolen work in intelligence and surveillance roles within the FBI.
What Happened
ShinyHunters claims it breached the FBI via a zero-day exploit, which is when a cyberattacker takes advantage of an unknown or unaddressed security flaw. InfoSecurity Magazine reported that the group “exploited a vulnerability in Oracle PeopleSoft before pivoting to AWS GovCloud servers and downloading 2-3TB of data.”
The FBI later determined that an Accenture contractor played a role by failing to implement a security patch that was specifically issued to secure the PeopleSoft platform. The FBI has stated that it removed the unnamed contractor and took all necessary steps to mitigate any further risk and protect its workforce. Additionally, one recommended remediation was for the FBI to implement rotating account credentials, suggesting that standing passwords contributed to the breach.
TSA Access Control Failures
The Department of Homeland Security (DHS) Office of Inspector General (OIG) issued a September 2026 report stating that the Transportation Security Administration (TSA) did not consistently implement access controls to protect its systems and information.
The report’s key findings identified several access control vulnerabilities that could allow an attacker to compromise TSA’s network, gain unauthorized access to sensitive information and cause serious damage to operations and assets.
Key Finding 1: TSA Did Not Secure Privileged and Service Accounts
The report found that TSA granted elevated rights to unauthorized accounts and did not consistently follow its privileged account approval process or annual review process. If attackers gained access to TSA’s privileged and service accounts, they could use this access to move across sensitive systems and elevate their privileges, increasing the likelihood of a successful attack and causing more severe impacts on critical systems.
Key Finding 2: TSA Did Not Consistently Disable Account Access for Separated Employees in a Timely Manner
A significant percentage of separated employees’ access was not disabled within the required timeframe. TSA primarily relied on automated inactivity controls, rather than promptly disabling accounts after receiving notification of an employee departure.
Key Finding 3: TSA Implemented Required System Settings and Updates
TSA generally implemented required system settings and addressed vulnerabilities for systems used to support its management of access controls. The report found that TSA implemented most of the required system settings and patched vulnerabilities for the two systems reviewed, with no unpatched vulnerabilities identified that met the reporting threshold.
The OIG report concluded with recommendations to improve TSA’s IT access controls. These recommendations include evaluating permissions granted to privileged accounts, ensuring privileged and service accounts are created only after required verification and approvals are complete and evaluating processes and resources for performing annual reviews of privileged and service accounts.
Protect Federal Systems with Keeper ICAM & Identity Security Platform for Government
These three incidents highlight the importance of protecting sensitive data and access to critical systems within the federal government.
Keeper ICAM & Identity Security Platform for Government provides federal agencies with FedRAMP High Certified identity security, enabling government agencies to:
- Eliminate standing credentials: Rotate passwords automatically on a defined schedule across all systems
- Control privileged access: Isolate and monitor privileged accounts with session recording, audit logging and just-in-time elevation
- Enforce access reviews: Automate periodic access certifications and compliance reporting
- Automate deprovisioning: Immediately revoke access for separated employees across all connected systems
Keeper’s identity security platform integrates seamlessly with federal identity providers and supports CAC and PIV smart card authentication, helping agencies meet federal identity assurance requirements such as FIPS 201 and NIST SP 800-63.
Learn how Keeper can help protect your federal systems from cyberattacks. Request a demo with our government solutions team today.
