I am a veteran, so this hits close to home. Most likely, my information, along with every other veteran that separated after 1975, has now been exposed to possible exploit.

This is a very good example of poor policies or poor policy enforcement when it comes to guarding sensitive data. Does the VA require that sensitive data be encrypted while at rest....probably not or we would of heard about that right away. How does an employee bring storage media into in a government facility and then walk out with 25 million rows of data? Is there no policy about connecting non-government devices to the government network?

Just 1 quick addition....I was reading some different news articles today and thought this article fit in nicely.

VA data loss could prompt federal privacy law