Booz Allen Hamilton: when the risk wears a badge, not a hoodie

As part of the AntiSec campaign led by former LulzSec members under the Anonymous banner, attackers said they broke into a Booz Allen Hamilton server and dumped login data in a release they branded “Military Meltdown Monday.” The group claimed roughly 90,000 military email addresses with encrypted/hashed passwords and said it had wiped around 4GB of source code. Booz Allen later confirmed an illegal attack had occurred and said it believed the damage was limited to a learning-management system run for a government agency; the US Department of Defense said it was aware of the incident.

The breach itself was acknowledged by the firm, but the headline figures (90,000 accounts, 4GB of code) originated with the attackers and were not independently confirmed; Booz Allen characterised the exposure as limited. Treat the event as real and the scale as the attackers’ claim that the firm scoped down — an early, externally-driven network intrusion rather than the insider pattern that dominates later.

Edward Snowden was working as a Booz Allen Hamilton infrastructure analyst assigned to an NSA facility in Hawaii when he removed classified NSA documents and passed them to journalists. Booz Allen confirmed he was an employee — on its payroll for under three months, at a salary it put at about $122,000 — and terminated him on 10 June 2013, roughly a day after he went public, citing violations of its code of ethics and firm policy.

This was an insider exfiltration by a cleared contractor, not a compromise of Booz Allen’s corporate network: the classified systems and data belonged to the NSA, and the firm’s role was as the employer whose vetting and privileged access the insider abused. The episode reshaped global debate on surveillance and became the defining case study in cleared-insider risk, trust and least privilege.

Harold Thomas Martin III, a Booz Allen Hamilton contractor holding a Top Secret clearance, was arrested in August 2016 after the FBI found a vast trove of classified material at his Maryland home and in his car. Prosecutors said he removed documents from the NSA, CIA, US Cyber Command and the National Reconnaissance Office over roughly two decades; his defence characterised it as compulsive hoarding to study for his work. He pleaded guilty in March 2019 to willful retention of national defense information and was sentenced that July to nine years in prison plus three years of supervised release.

A court-confirmed insider case: investigators never established that Martin transmitted the material to anyone, but prosecutors called the conduct “breathtaking in its longevity and scale.” Coming three years after Snowden, it underlined that the firm’s most serious documented exposures ran through trusted cleared people and the client agencies’ data they could reach — not through its own externally-breached infrastructure.

UpGuard analyst Chris Vickery found a publicly accessible Amazon S3 bucket, unprotected by even a password, holding data tied to a Booz Allen Hamilton project for the National Geospatial-Intelligence Agency (NGA). The exposed material included what appeared to be SSH keys belonging to a Booz Allen engineer and credentials granting administrative access to at least one data center’s operating system, relating to systems used to provision servers for intelligence data. Vickery notified Booz Allen’s CISO on 24 May and escalated to the NGA on 25 May; the NGA secured the repository nine minutes after that escalation.

A classic cloud-misconfiguration exposure — no hacking required, just a bucket left open. Booz Allen and the NGA said the storage was not connected to classified networks and the NGA reported no evidence that classified information was compromised, but the leaked credentials could have provided a foothold into sensitive government systems. Domain registrations and credentials in the data pointed to Booz Allen (and fellow NGA contractor Metronome); the firm acknowledged the incident and investigated.