A government contractor made a network change that exposed a potential path into production systems holding about 50 million U.S. immigration records. According to a former information system security officer, developers got firewall rules changed so a provisioning server in a lower-security commercial datacenter could reach production servers in a classified government datacenter; thousands of users could access the commercial VPN, there was reportedly no multi-factor authentication, and the risk was unauthorized access from a much broader network than intended.
Why it matters: This is the kind of avoidable segmentation failure that can turn a test or support environment into a gateway to highly sensitive government data. Government agencies and contractors should review firewall exceptions, VPN trust boundaries, MFA coverage, and any dev-to-production connectivity that could expose regulated or classified systems.
2026.09.24
100% relevant
This article appears to establish a distinct story about a government contractor's network misconfiguration creating exposure risk for immigration records, not an update to an existing tracked event.
← Back to all stories