Extensive US civil servant credential exposure uncovered

U.S. civil servants had 53,070 passwords leaked publicly since the beginning of last year, FedScoop reports.

Most of the exposed credentials were from the State Department, while the Defense Department had the greatest exposure of unique passwords, according to a NordPass report. Also among the most impacted were the U.S. Army and the Department of Veterans Affairs, as well as the Washington, D.C., government, and the City of Virginia Beach.

Additional findings showed that more than 91,000 credentials with matching email addresses and public-sector domains across six countries.

"If affected passwords weren't updated following the related incidents and multi-factor authentication wasn't switched on, attackers could have potentially accessed these accounts and other sensitive information, creating data security risks," said the report.

While neither the Pentagon nor the VA commented on the findings, the State Department emphasized its commitment to improving cybersecurity through regular credential rotation and multi-factor authentication.