A DOD contractor’s API flaw exposed military course data and service member records

CyberScoop

May 6, 2026 at 9:15 PM

Overview

Researchers discovered a significant flaw in the API of Schemata, a contractor for the Department of Defense, which exposed sensitive information related to military courses and service members. This breach included personal details such as names, email addresses, base assignments, and course materials before Schemata implemented a fix and informed government officials. The exposure raises serious concerns about the security of military data and the potential risks to service members' privacy. Such incidents highlight the need for stringent security measures among contractors handling sensitive government information. The incident serves as a reminder of the vulnerabilities that can exist in systems that support military operations.

Key Takeaways

Affected Systems: Schemata API, military course data, service member records
Action Required: Schemata patched the issue and contacted government authorities.
Timeline: Newly disclosed

Original Article Summary

Researchers say Schemata’s platform exposed names, emails, base assignments, and course materials before the company patched the issue and contacted government authorities. The post A DOD contractor’s API flaw exposed military course data and service member records appeared first on CyberScoop.

Impact

Schemata API, military course data, service member records

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Schemata patched the issue and contacted government authorities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Roku sued for allegedly bricking TVs - see which models are affected, and your best alternatives

FTC bans Kochava from selling location data without consent

SCM feed for Latest

The Federal Trade Commission (FTC) has banned Kochava, a data broker, from selling geolocation data without user consent. The FTC's complaint revealed that Kochava collected and sold location data from hundreds of millions of mobile devices, allowing clients to monitor users' movements to sensitive locations like health clinics and places of worship. This practice raised significant privacy concerns, as it involved tracking individuals without their knowledge or approval. The ruling emphasizes the need for stronger protections around personal data and could set a precedent for how data brokers handle user information in the future. Consumers are increasingly wary of how their data is used, and this decision reflects a growing push for accountability in the industry.

May 6, 2026

Why ransomware attacks succeed even when backups exist

BleepingComputer

Ransomware attacks are increasingly successful even when organizations have backups, primarily because attackers often target and destroy these backups before encrypting the main data. Acronis explains that this tactic leaves victims with little to no options for recovery, as the backups become unusable. This highlights a significant vulnerability in many organizations' cybersecurity strategies, as they may rely too heavily on backups without considering their protection. Companies need to bolster their defenses by securing backup systems and implementing strategies that can withstand ransomware attacks, ensuring they have a path to recovery even if their primary data is compromised.

May 6, 2026

CISA Urges Critical Infrastructure Providers to Make Plans to Remain Operational if hit by Cyber-Attack

Infosecurity Magazine

CISA has launched the CI Fortify initiative, urging critical infrastructure operators to develop plans to stay operational in the event of a cyber-attack. This initiative is designed to help these operators create systems for isolating affected areas and recovering from attacks quickly. The focus is on ensuring that essential services, such as power, water, and transportation, remain functional even when targeted by cyber threats. The call to action comes as cyber threats continue to evolve, making it crucial for these operators to have effective response strategies in place. CISA emphasizes that preparation can significantly mitigate the impact of potential attacks on public safety and national security.

May 6, 2026

After the identity fix: MCP's confused deputy problem

SCM feed for Latest

The article discusses a potential issue with AI agents acting as 'confused deputies,' which means they may perform unintended actions based on users' requests. This can lead to security vulnerabilities where the AI might execute commands that the user did not intend, potentially exposing sensitive data or causing other negative consequences. The implications of this problem are significant, as it raises concerns about the reliability and safety of AI systems in various applications. Users and developers need to be aware of these risks to ensure that AI implementations are secure and do not inadvertently compromise user intentions. As AI technology becomes more prevalent, addressing these issues will be crucial for maintaining trust and safety in digital environments.

May 6, 2026

Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE

Security Affairs

Apache has released updates to address multiple vulnerabilities in its HTTP Server, including a serious flaw identified as CVE-2026-23918. This vulnerability, which has a CVSS score of 8.8, is a double-free error in the handling of HTTP/2 requests. If exploited, it could allow attackers to execute arbitrary code on affected systems. Organizations using Apache HTTP Server, particularly those enabling HTTP/2, should prioritize updating their software to mitigate this risk. The nature of the flaw makes it critical for system administrators to be proactive in applying the latest patches to safeguard against potential attacks.

May 6, 2026