GSA Exposes Sensitive Files Due to Security Tool Limits
An OIG audit reveals 116 internal files were exposed due to software that cannot scan documents larger than 15 megabytes.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust federal agencies to secure sensitive information stored in public cloud-based systems?
An Office of the Inspector General audit found that the General Services Administration inadvertently exposed 116 sensitive files to all agency users via Google Drive. The exposed documents included personally identifiable information and physical security plans for agency buildings.
Why it matters
The security failure highlights a critical breakdown in data loss prevention management, where technical limitations and poor oversight left internal documents accessible to unauthorized personnel. This event underscores the risks inherent in using third-party tools that fail to account for large file sizes or evolving search requirements.
The agency's $7.8 million data loss prevention tool failed to detect the exposed files because it cannot process documents exceeding 15 megabytes in size. Additionally, the software's efficacy was limited by search terms that were not effectively updated.
The players
General Services Administration
The federal agency responsible for managing government property, supply chains, and digital workspaces for federal employees.
GSA Office of the Inspector General
The independent oversight body responsible for auditing agency operations and investigating mismanagement or security failures.
The details
The General Services Administration, or GSA, failed to implement standard naming conventions or a formal approval process for sharing sensitive information across its Google Drive environment. Controlled unclassified information, or CUI — government data that requires safeguarding but is not classified — remained accessible to all agency users due to ineffective configuration of third-party protection software. Over half of the exposed documents contained physical site plans and security area layouts, while five files included personally identifiable information such as dates of birth and Social Security numbers.
Timeline
2015-2024: The period during which the GSA failed to complete annual reviews for its data protection tool.
March-December 2025: The timeframe of the OIG audit into GSA Google Drive usage.
April 2025: A prior OIG investigation addressed similar CUI exposure issues.
September 2026: The reported cumulative spending on the agency's data loss prevention tool.
October 27, 2026: The official release date of the OIG audit report.
The Tech Race
The GSA struggle mirrors findings from the April 2025 OIG investigation into CUI exposure, indicating a recurring challenge in governing agency-wide document management. Despite spending $7.8 million on defensive software, the agency continues to fall behind in establishing the technical controls necessary to manage its 2.5 million documents.
The security lapse affects GSA contractors and employees whose sensitive data, such as Social Security numbers and vendor proposals, was improperly exposed. While the OIG has issued seven recommendations for remediation, the agency has not provided a timeline for when these controls will be fully operational.
The takeaway
The GSA's failure highlights the dangers of relying on automated tools without regular audits or clear file management policies. Observers should track the agency’s progress on the seven OIG recommendations to see if it can close the identified gaps in its data protection infrastructure.
Further reading
For broader insights into federal digital security, explore recent reports in Cybersecurity.
Source note: This article includes information reported by FedScoop.
Live Poll
Do you trust federal agencies to secure sensitive information stored in public cloud-based systems?
