Nine Months Unnoticed: What the Pentagon Breach Teaches About File-Sharing Systems

The US Defense Manpower Data Center (DMDC) found a vulnerability in one of its file-sharing systems on 16 July 2026. By then, unauthorised users had been accessing files on a server with unencrypted personal data since October 2025. About 2.76 million living people and around 294,000 deceased people are affected. Our news item has the details.

The headline number is large, but the more useful number for a SOC team is nine. For about nine months, someone was reading files and nobody noticed.

Why file-sharing systems are a blind spot

File-sharing and file-transfer platforms sit in an awkward place. They hold some of the most sensitive data an organisation has, yet they are rarely watched as closely as endpoints or email.

• No malware is needed. An attacker who can read files through a flaw or a stolen account simply downloads them. Endpoint detection has nothing to catch.
• Access looks like normal use. Reading files is what these systems are for. A single download is not suspicious.
• Logs often stay local. Many platforms keep audit logs inside the application, where nobody reviews them, instead of sending them to the SIEM.
• Data is often unencrypted at rest. The DMDC server held unencrypted personal data, so access meant exposure.

What good monitoring looks like

Get the logs out

Every file platform that holds sensitive data should send its access and administration logs to your SIEM: who read which file, from where, and when. Without this, there is nothing to investigate.

Know what normal looks like

Most users touch a small, stable set of files. Alerts become useful when they compare activity with that baseline:

• An account reading far more files than usual.
• Access from a new network, country or device.
• Steady, low-volume reading of many files over days, which is easy to miss in daily totals.
• Access to old or archived folders that nobody has opened in months.

Treat the platform as a target

Track vulnerabilities in your file-sharing and file-transfer products like you track edge devices. When a flaw is published, look back through the logs for signs it was used before you patched. Our analysis of this month's edge device zero-days covers the same approach for gateways and controllers.

Reduce what can be lost

Encrypt sensitive data at rest, remove stale shares and expire old links. Monitoring shortens the time to detection; less exposed data limits the damage.

Where AI triage helps

Low-and-slow access is hard for rules. A threshold strict enough to catch it fires on every busy analyst; a loose one misses it entirely. The signal is in the combination: an unusual source, an unusual volume and unusual folders, on an account whose normal behaviour is known.

Claire Security investigates alerts like these with an agentic reasoning loop. It gathers context from connected systems, compares activity with the account's history and passes analysts a verdict with the reasoning attached. Running on your own servers, it keeps file access logs, which are sensitive in themselves, inside your environment.

A short checklist

• List every file-sharing and file-transfer platform that holds sensitive data.
• Send their access and admin logs to your SIEM.
• Alert on unusual volume, sources and long-unused folders.
• Encrypt data at rest and remove stale shares.
• After every new vulnerability in these products, hunt back through the logs.