The US Air Force is investigating a critical data breach involving the exposure of Personally Identifiable Information (PII) and Protected Health Information (PHI) due to vulnerabilities in Microsoft SharePoint. The breach, linked to Chinese-affiliated hacking groups (Linen Typhoon, Violet Typhoon, Storm-2603), exploited authentication bypass and remote code execution flaws, enabling unauthorized access to sensitive data, including MachineKey information. As a precaution, the Air Force blocked all SharePoint access across its systems, with potential extensions to Microsoft Teams and Power BI dashboards due to their integration with SharePoint. The incident follows a broader pattern of state-sponsored cyberattacks targeting US federal agencies, raising concerns over national security and data integrity. The breach’s full scope remains under investigation by Microsoft and US authorities, with suspicions also directed toward Russian state-sponsored actors given historical precedents. The exposed data includes highly sensitive military personnel records, posing risks of identity theft, espionage, or operational disruptions.

The U.S. Air Force experienced significant disruption due to coordinated DDoS attacks orchestrated by pro-Iranian hacktivist groups following geopolitical tensions. These attacks, executed by groups like Mr Hamza and Keymous+, targeted military domains and resulted in sustained downtime over 10-hour periods. The Department of Homeland Security issued warnings about potential low-level and sophisticated attacks, highlighting the persistent threat to national cybersecurity infrastructure.

Thousands of US Air Force records, including highly private personnel data on senior and high-ranking commanders exposed due to an unprotected backup disc. The compromised data includes personal information, such as names and addresses, ranks, and Social Security numbers of more than 4,000 officers. Another file lists the security clearance levels of hundreds of other officers, some of whom possess "top secret" clearance, and access to the sensitive compartmented information and codeword-level clearance. The internet-connected backup drive's lack of a password made the gigabytes of files accessible to everyone, according to security researchers.