GSA Audit Finds Sensitive Files Exposed in Drive

An inspector general report reveals 116 internal files were left accessible to all employees.

Updated on Oct. 28, 2026 in Cybersecurity

Isometric editorial illustration showing a secure steel lockbox inside a structural frame, representing government data security. — A GSA Inspector General audit found 116 sensitive internal documents were improperly exposed to agency-wide access, revealing significant gaps in data management. AI Illustration. Upload story photo >

Live Poll

Do you trust federal agencies to secure sensitive information stored in public cloud-based systems?

The General Services Administration Inspector General discovered that 116 sensitive documents were incorrectly shared across the entire agency in Google Drive. These files included both personal data and sensitive information regarding building security.

Why it matters

The security lapse highlights significant gaps in the agency's data loss prevention management and oversight protocols. The failure occurred despite millions in spending on specialized software meant to safeguard controlled information.

The agency's $7.8 million third-party data loss prevention tool is unable to scan files larger than 15 megabytes. Additionally, the software failed to detect exposed documents because search parameters were not effectively updated.

The players

General Services Administration

This federal agency manages government buildings, supplies, and office space for other departments.

General Services Administration Office of the Inspector General

This independent oversight body is responsible for auditing agency operations and investigating potential misconduct or security failures.

The details

Exposed documents included Social Security numbers, dates of birth, and vendor proposals, alongside sensitive building site and floor plans. Approximately one-third of the identified files were marked as for official use only, and the agency currently lacks standardized naming or sharing protocols for sensitive records.

Annual data tool reviews were missing for the period of 2015-2024.
The OIG conducted the audit of the GSA Google Drive between March and December 2025.
A previous investigation into sensitive information exposure occurred in April 2025.
The agency reported $7.8 million in total spending on its data loss tool as of September 2026.
The Office of the Inspector General released the final report on October 27, 2026.

The Tech Race

This exposure follows a pattern of digital oversight failures across federal agencies attempting to modernize data storage through cloud-based platforms. The incident highlights how legacy security protocols often struggle to keep pace with the scale of enterprise cloud document management.

While the incident impacts internal agency operations, it highlights broader concerns regarding the security of personally identifiable information held by federal bodies. Ongoing improvements to automated detection tools are required to better protect sensitive records from accidental wide-scale exposure.

The takeaway

Agencies must ensure that automated security tools are both technically capable of handling large file sizes and regularly updated with current search terms. Strengthening internal naming conventions remains a critical step for preventing future data leaks.