[Breaches](/breaches) Black Box, Red Disk: How Top Secret NSA and Army Data Leaked Online [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Black Box, Red Disk: How Top Secret NSA and Army Data Leaked Online ##### [UpGuard Team](/team/upguard) Published Nov 28, 2017 ##### Join 27,000+ cybersecurity newsletter subscribers *While this blog post provides a description of a data exposure discovery involving the *[*United States Army Intelligence and Security Command (INSCOM)*](https://www.inscom.army.mil/)*, this is no longer an active *[*data breach*](/blog/data-breach)*. As soon as the UpGuard Cyber Risk Team notified  INSCOM of this publicly exposed information, immediate action was taken, securing the open buckets and preventing further access.  * In the wake of a string of data exposures originating from Pentagon intelligence-gathering agencies, [the most recent of which revealed the workings of a massive, worldwide social media surveillance program](/breaches/cloud-leak-centcom), the UpGuard Cyber Risk Team can now disclose another. Critical data belonging to the [United States Army Intelligence and Security Command (INSCOM)](https://www.inscom.army.mil/), a joint US Army and National Security Agency (NSA) Defense Department command tasked with gathering intelligence for US military and political leaders, leaked onto the public internet, exposing internal data and virtual systems used for classified communications to anyone with an internet connection. With [a middling CSTAR cyber risk score of 589 out of a maximum of 950](https://app.upguard.com/#/https://www.inscom.army.mil/), INSCOM’s web presence provides troubling indications of gaps in their cybersecurity - exemplified by the presence of classified data within this publicly accessible data repository. Among the most compelling downloadable assets revealed from within the exposed bucket is a virtual hard drive used for communications within secure federal IT environments, which, when opened, reveals classified data labeled [NOFORN](https://www.spiegel.de/international/world/glossary-of-nsa-abbreviations-a-975930.html) - a restriction indicating a high level of sensitivity, prohibited from being disseminated even to foreign allies. The exposed data also reveals sensitive details concerning the Defense Department’s battlefield intelligence platform, [the Distributed Common Ground System - Army (DCGS-A)](https://asc.army.mil/web/portfolio-item/iews-dcgs-a/) as well as [the platform’s troubled cloud auxiliary, codenamed “Red Disk.”](https://nypost.com/2014/10/27/army-spent-5b-on-failed-technology-created-by-vets/) This cloud leak follows a number of previous Cyber Risk Team reports detailing Pentagon data exposures from within [the US Central Command, US Pacific Command](/breaches/cloud-leak-centcom), and [the National Geospatial-Intelligence Agency](/breaches/spy-games-booz-allen-hamilton-pentagon), a Defense Department agency tasked with acquiring and analyzing satellite imagery intelligence. Such continual and apparently accidental exposure of classified national security data to the wider internet is proof that even the most secretive corners of the IT landscape are not immune to the [cyber risks](/blog/cybersecurity-risk) befalling any enterprise operating at scale. In order to stop and shift away from the regular revelations of another exposed intelligence operation, federal stakeholders must begin to regain control of their systems, reducing their complexity by gaining full visibility into the complex workings of the government’s cyber presence. ## The Discovery On September 27th, 2017, UpGuard Director of Cyber Risk Research Chris Vickery discovered an Amazon Web Services [S3 cloud storage bucket configured for public access](https://www.upguard.com/blog/check-your-amazon-s3-permissions-someone-will). Set to allow anyone entering the URL to see the exposed bucket’s contents, the repository, located at the AWS subdomain “inscom,” contained 47 viewable files and folders in the main repository, three of which were also downloadable. The subdomain name provides some indication as to the provenance of the data: INSCOM, an intelligence command overseen by both the US Army and the NSA. The three downloadable files contained in the bucket confirm the highly sensitive nature of the contents, exposing national security data, some of it explicitly classified. The largest file is an Oracle Virtual Appliance (.ova) file titled “ssdev,” which, when loaded into VirtualBox, is revealed to contain a virtual hard drive and Linux-based operating system likely used for receiving Defense Department data from a remote location. While the virtual OS and HD can be browsed in their functional states, most of the data cannot be accessed without connecting to Pentagon systems - an intrusion that malicious actors could have attempted, had they found this bucket. However, the properties of files revealed in this hard drive contain areas and technical configurations clearly marked as “Top Secret,” as well as the additional intelligence classification of “NOFORN,” a stipulation which means the data is so sensitive, it cannot even be shared with foreign allies. The hard drive contains six such partitions, varying in size from 1 GB to 69 GB, and contains indications in its metadata that the box was worked on in some capacity by a now-defunct third-party defense contractor named Invertix, [a known INSCOM partner](https://nypost.com/2014/10/27/army-spent-5b-on-failed-technology-created-by-vets/). Finally, also exposed within are private keys used for accessing distributed intelligence systems, belonging to Invertix administrators, as well as hashed passwords which, if still valid and cracked, could be used to further access internal systems. While the specific purpose of the virtual drive’s partitions are unclear, the file appears to be of use for receiving, transmitting, and handling classified data. A folder within the hard drive reveals a human-configured installation of files for use with Red Disk, [a troubled Defense Department cloud intelligence platform](https://nypost.com/2014/10/27/army-spent-5b-on-failed-technology-created-by-vets/) partially integrated into the Pentagon’s DCGS-A program. The second downloadable file, a plaintext ReadMe document stored within the virtual hard drive, provides indications of instruction for the contents of the .ova and where to obtain additional Red Disk packages. The final downloadable file, a compressed .jar titled “rtagger,” appears to constitute a training snapshot for labeling and categorizing classified information, as well as assigning such data to “regions.” Such a function would be of vital use for the remote receipt and analysis of classified information, possibly via a virtual appliance of the sort already discussed. ## The Significance Plainly put, the digital tools needed to potentially access the networks relied upon by multiple Pentagon intelligence agencies to disseminate information should not be something available to anybody entering a URL into a web browser. Although the UpGuard Cyber Risk Team has found and helped to secure multiple data exposures involving sensitive defense intelligence data, this is the first time that clearly classified information has been among the exposed data. It is unnecessary to speculate as to the potential value of such an exposed bucket to foreign intelligence services or malicious individual actors; the care taken to classify sections of the exposed virtual drive as “Top Secret” and “NOFORN” provide all the indications necessary to determine how seriously this data was taken by the Defense Department. Finally, the subdomain name for the S3 bucket, “INSCOM,” provides little ambiguity to any bad guys seeking to determine the data’s significance. If, then, such a high level of [sensitivity is inherent to the data](https://www.upguard.com/blog/sensitive-data), how could it be exposed? Regrettably, this cloud leak was entirely avoidable, the likely result of process errors within an IT environment that lacked the procedures needed to ensure something as impactful as a data repository containing classified information not be left publicly accessible. Given how simple the immediate solution to such an ill-conceived configuration is - simply updated the S3 bucket’s permission settings to only allow authorized administrators access - the real question is, how can government agencies keep track of all their data and ensure they are correctly configured and secured? Doing so requires full visibility into the real-time state of all relevant IT systems, as well as possessing the necessary oversight and ability to make changes when necessary. Unfortunately, the indications that some of the data in the bucket had been access and worked upon by Invertix, the external third-party vendor, provides some indication of another difficulty faced in regaining trust in digital systems. Third-party vendor risk remains a silent killer for enterprise cyber resilience. The transfer of information to an external contractor, such as Invertix, exposes the originating enterprise (in this case, INSCOM) to the consequences of a breach, but without direct oversight of how the data is handled. Invertix has since merged into a new corporation, [Altamira, which registers a CSTAR score of 513](https://app.upguard.com/#/http://www.altamiracorp.com/). If the right hand does not know what the left hand is doing, the entire body will be injured. The Defense Department must have full oversight into how their data is handled by external partners, and be able to react quickly should disaster strike.  ## How UpGuard can help detect and prevent data breaches and data leaks UpGuard helps security teams proactively detect and shut down data breach risks that[ impact their internal security posture](https://www.upguard.com/product/breach-risk) and the security postures[ of all third-party relationships](https://www.upguard.com/product/vendorrisk). [UpGuard can also continuously monitor the open, deep, and dark web](https://www.upguard.com/product/breach-risk/threat-monitoring), discovering stolen credentials and leaked data before they're weaponized. Its AI Threat Analyst acts as a virtual Tier 1 analyst, filtering out noise and elevating only high-confidence threats from sources like malware logs, ransomware leak sites, and encrypted messaging platforms.  The resulting significant reduction in false positives equips security teams to execute fast and targeted responses on risks that actually matter. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)