Top-secret data on military personnel and contractors has been exposed online in another case of a company misconfiguring Amazon Web Service Inc. cloud storage service.

The latest AWS bungle comes from a private military contractor from North Carolina called TigerSwan. It involves resumes and other personal details for job applicants, including information classified “Top Secret,” being left on an S3 bucket, or unit of cloud storage, that had been configured to allow public access.

If configuring an S3 bucket insecurely isn’t bad enough, the company was allegedly warned that the files on the server were publicly available in July but the files remained accessible until Aug. 24.

“The exposed documents belong almost exclusively to US military veterans, providing a high level of detail about their past duties, including elite or sensitive defense and intelligence roles,” security firm UpGuard Inc., who made the initial discovery, wrote in a blog post Saturday. “They include information typically found on resumes, such as applicants’ home addresses, phone numbers, work history, and email addresses” but also “sensitive information, such as security clearances, driver’s license numbers, passport numbers and at least partial Social Security numbers.”

TigerSwan aimed to deflect the blame, accusing a subcontractor it uses called TelentPen LLC for the security breach. “TalentPen never notified us of their negligence with the resume files nor that they only recently removed the files,” the company said in a statement Saturday. “It was only when we reached out to them with the information on Aug. 31 did they acknowledge their actions.”

John Suit, chief technology officer at data protection firm Trivalent Inc., told SiliconANGLE that roughly 9,400 documents were exposed in the breach, highlighting the damaging effects of leaving critical data unprotected. “This information was discovered in a folder labeled ‘resumes’ that was in a visible location accessible by malicious parties. This breach highlights the importance of taking the guesswork out of data security by employing protection at the file level, which ensures individual files are protected at all times.”

Noting that this wasn’t the first time confidential data had been exposed on AWS, Fugue Inc. Chief Executive Officer Josh Stella explained to SiliconANGLE that “exposures due to human error, such as misconfigured AWS S3 buckets, are going to continue as long as organizations fail to implement policy-as-code and full infrastructure lifecycle automation.

“If you still rely on bolted-on security monitoring, manual incident remediation and security audits to keep your data safe, your organization will remain at risk of these kinds of breaches,” he added.

Military contractors seem to be particularly inept at configuring security settings on AWS. Booz Allen Hamilton Inc. also exposed confidential data in a similar fashion in June.

Photo: U.S. Marine Corps/Wikimedia Commons