Two Marines filed a class action lawsuit Tuesday against the Pentagon, alleging that serious cybersecurity failures at the Defense Manpower Data Center allowed scammers to obtain and misuse their personally identifiable information.

The complaint was filed in federal court in the District of Columbia by Marine veteran Tristyn Edwards and active duty Marine Morgan Stampfli. Both allege they experienced fraudulent charges on financial accounts and an increase in spam messages because of the breach.

The DMDC said in September that it discovered a vulnerability on July 16 within a file sharing system. That weakness allowed unauthorized users to access unencrypted files containing personal information.

The exposed information included full names, Social Security numbers, birth dates and military occupations. According to the lawsuit, millions of files containing information about service members and other people affiliated with the military were exposed.

The vulnerability remained undiscovered for approximately nine months, the lawsuit alleges. During that period, unauthorized users allegedly had the ability to reach files containing sensitive personal records.

The Marines also accuse the DMDC of failing to “promptly notify” affected individuals after discovering the breach. According to the complaint, some people did not receive notification until two or three months after the vulnerability was found.

“The exposure of Plaintiff and Class members’ PII will cause various types of misuse in the coming months and years, including but not limited to, unauthorized credit card charges, unauthorized access to email accounts, identity theft, and other fraudulent use of their Private Information,” the lawsuit says.

The complaint argues that the threat did not end when the vulnerability was discovered. It alleges that exposed information could continue to be misused for identity theft, financial fraud and unauthorized access to personal accounts.

At the center of the case is the allegation that the Pentagon violated federal privacy laws. The Marines contend that officials failed to protect personal records and maintain cybersecurity systems that complied with required standards.

The complaint says those failures occurred despite internal warnings about problems affecting the systems. It cites multiple reports from the War Department’s Office of Inspector General describing failures by both the department and the DMDC to establish adequate cybersecurity controls.

One report was published only days after the breach. The Office of Inspector General said that “officials have not taken the necessary actions to demonstrate that they were operating at an effective level for 14 of the 20 [Inspector General Federal Information Security Modernization Act] core metrics.”

That finding is cited by the Marines as evidence that officials had not completed necessary cybersecurity work. Their lawsuit argues that standard controls could have protected the sensitive information stored within the affected system.

“Had [the War Department] properly implemented standard cybersecurity controls — such as regular review of accounts, scanning for vulnerabilities, field encryption or tokenization of sensitive PII like SSNs, and routine monitoring of system logs for suspicious activity — the Data Breach could have been avoided,” the lawsuit says.

News of the War Department breach emerged alongside reports about a separate cyberattack targeting FBI personnel files. However, the group responsible for the FBI incident has not been linked to the Pentagon breach.

The department responded by offering affected individuals 12 months of credit monitoring and identity restoration services. The lawsuit nevertheless alleges that the exposure could produce misuse of personal information during the coming months and years.

Edwards and Stampfli are pursuing the case on behalf of a proposed class of affected people. Their complaint focuses on the nine month exposure, delayed notifications, alleged misuse of their information and earlier warnings about inadequate cybersecurity controls.