The 2027 Congress will have many possible issues on its plate related to technology and national security. One of those areas for potential oversight, legislation, and support to public servants in the national security community—including from a bipartisan standpoint—is ensuring mitigations of the multiple, serious data breaches that have recently impacted the executive branch.
Unauthorized users, it was revealed in September, accessed a Department of Defense (DOD) human resources database containing Social Security numbers and job details about 2.76 million living personnel and 294,000 deceased individuals. Hackers broke into an FBI jobs portal and stole data about thousands of personnel, including those working in highly sensitive roles spanning counterintelligence, “clandestine technical operations,” Russia, China, Iran, Hezbollah, and critical infrastructure. And another group of hackers got into the Department of Homeland Security’s (DHS) personnel files and published, in a searchable database online, the names, phone numbers, and addresses of more than 40,000 DHS agents, including those reportedly working in undercover positions.
These three breaches occurred within a short, couple-month span and constitute a dangerous pileup of data thefts and leaks. Collectively, they have exposed millions of U.S. government personnel to changing risks of foreign intelligence collection, foreign nation-state approaches or blackmail, physical targeting by violent crime organizations such as cartels, and myriad cyber and identity theft threats. As the next Congress determines its priorities, and as members work to ascertain areas in which there might be opportunities for bipartisan collaboration, Congress should seek to understand the situation and its potentially wide-ranging impacts on national security. This includes examining what happened in these breaches, what they mean individually and in aggregate, and what is being and should be done about it. Assessing the mitigations should span at least three areas: (1) technical security of systems, (2) physical protection for personnel as necessary, and (3) security measures in response to the resulting counterintelligence risks.
Two Core Oversight Steps
Addressing a problem first requires understanding it. In that vein, Congress could examine whether the relevant executive branch agencies involved in these data breaches have fully assessed the likely scope of the incidents. It is not clear this has been done to date. For example, the FBI breach was originally reported to impact just FBI personnel. Then, the Justice Department reportedly sent a memo to select personnel informing them that their data may also have been compromised in the intrusion. The breaches at the DOD and DHS could likewise potentially contain information on more people than originally understood; they are both large organizations, and the scope of many breaches does not become clear until, sometimes, months or even years down the line. Ensuring a thorough investigation of the scope of such incidents is essential to knowing how many personnel, how many data points, how many sub-entities of the executive branch, which systems, and what equities were affected or implicated.
From there, Congress could take up at least three urgent questions that follow from better grasping the scope of the breach pileup. First is the question of whether the systems themselves have been technically investigated and subject to containment and recovery measures. Any standard breach response will involve steps such as trying to get the hackers out of a system, ensuring they are no longer in the system, and patching up the flaws they exploited to the extent possible. But amid much turbulence at some of these agencies, the potential for a private company to be involved (at least, reportedly, in the case of the FBI breach), and mass firings and departures of cybersecurity professionals in the federal government, bipartisan oversight might seek to get a more detailed picture of how the technical fallout is being managed.
The second critical question Congress could ask, after understanding the breach’s scope and the technical state of play, is around physical personal protection. Not every bad actor that could access the breached data might seek to physically harm U.S. government personnel whose data was stolen or compromised. For example, even an adversarial nation-state such as China or Russia would not be likely to start targeting individual FBI employees or DHS personnel with violence. However, the same cannot be said for the Iranian government—a known state sponsor of terrorism that has tried in recent years to assassinate a former senior official and the president, both within the borders of the United States. It might relish the opportunity to learn the names and home addresses of FBI agents working to recruit sources against its interests.
Likewise, transnational criminal organizations, especially cartels, could exploit the breaches at the FBI and DHS to find and physically target those working against their activities—or use the information to try to uncover informants that they could then silence. As the DOD works on the southern border, it is not unimaginable that cartels might take an interest in the personnel impacted in the enormous DOD breach, too. Congress could seek to understand how the respective agencies’ security divisions and other relevant executive branch organizations are working to ensure that personnel impacted by the breaches have necessary risk assessments and are provided protections against potential harm. In the wrong hands, data breaches of this kind could quickly move from an abstract-sounding statistic to an incident of physical violence.
The third critical question that Congress could investigate about these breaches is what the executive branch is doing about their counterintelligence implications. All these breaches, especially the FBI breach, are a counterintelligence disaster for the United States. Beyond mitigating the risks of physical violence, any executive branch response to these breaches must also account for how sophisticated, persistent, and well-resourced foreign adversaries such as China and Russia would use the gold mines of information for several purposes. Foreign nation-states could use personnel files and job titles to flesh out their pictures of U.S. government organizational charts, such as better mapping the FBI’s national security activities. They could use data, such as from the FBI jobs portal or the DOD human resources database, to identify personnel who work on issues of great strategic concern to them, such as export controls, weapons proliferation, or counterterrorism. From there, foreign intelligence services could target those U.S. persons with approaches, phishing attacks, and much more to attempt to glean information.
Foreign adversaries could also use the data to augment their profiles of earlier-career U.S. personnel—including those who work roles today less relevant to their interests (e.g., white-collar crime) but could move in the future to more relevant positions (e.g., countering Chinese or Russian espionage). This means that any examination of the breaches’ counterintelligence implications must especially consider how the data may or may not still provide value to an adversary several years from now. Likewise, any assessment should consider that in the AI era, every data breach can be combined with other data sets, augmented and analyzed with AI models, and used to much greater effect against U.S. security. Each of the incidents should therefore be understood in and of itself, as well as collectively.
Moving to Action
Congress has much on its plate for 2027. There is also much doubt about how many areas of common ground the two parties can find. But in an era of continued bipartisan consensus on threats from China, the importance of cybersecurity, and the need to better protect public servants, urgent opportunities lie in understanding these data breaches, ensuring the right mitigations, and using them to speak to broader strategic issues for the United States.
Justin Sherman is a senior associate (non-resident) with the Intelligence, National Security, and Technology Program at the Center for Strategic and International Studies in Washington, D.C.
