US Military Data Leak Exposes 70,000 Files via Unsecured Directory In April 2026, researchers at Cybernews uncovered a leaky directory containing over 70,000 sensitive files related to US military personnel, contractors, and internal base infrastructure. The exposed dataset, belonging to government contractor CMI Management Inc. (a subsidiary of Dexterra Group), included maintenance records, staff emails, internal photos of military bases, and schematics some of which could enable threat actors to map vulnerabilities in secure facilities. The vulnerability stemmed from an Open Directory Listing flaw, allowing unrestricted access to the files. Despite being notified by security researcher Arkadeep Roy in 2024, the directory remained exposed for over a year, with Cybernews confirming its active leak as recently as March 2026. The firm reported the issue to CISA and CMI Management on 18 March 2026, though no immediate response was received. The breach poses significant risks, including phishing, impersonation, and unauthorized access to military installations. The exposure of base schematics and internal imagery could further aid adversaries in identifying structural or security weaknesses. Cybernews researchers noted that the incident highlights persistent gaps in securing sensitive military data, even after authorities are alerted. The leak follows a March 2026 CISA alert on hardening endpoint systems, issued in response to the Stryker Corporation cyberattack. CMI Management, which provides facility services to government agencies, has not publicly addressed the breach.