GSA audit exposes internal sharing gaps
The agency’s response reports later corrective work.
- Event / announcement date
- 2026-10-27
An October 27 GSA audit found 116 sensitive files accessible to all agency employees and contractors during 2025 testing. The judgmental search cannot estimate all exposures or establish public-internet access. [1]
The problem predates this audit: an August 2014 alert found sensitive building information accessible without a need to know and missing proper labels. Publicly reissued in January 2017, that alert urged access restrictions, labeling and training. Its release notice explicitly warned that republication did not mark a new incident. [2]
GSA’s October 5 response reports deployment of image-text recognition and no external exposure or indication of malicious intent in those files. It agreed to seven detection and sharing recommendations; completion remains unverified. [1]
The source
- GSA OIG: Cloud-sharing audit ↗
Source date 2026-10-27 · reviewed October 30, 2026 - GSA OIG: Earlier cloud-sharing warning ↗
Source date 2017-01-27 · reviewed October 30, 2026 · Public reissued January27,2017; original report dated August19,2014, with a December15,2015 methodology addition.
About this item: News report. No first-hand reporting or independent testing is claimed. Corrections policy.
