US Watchdog Finds 116 Sensitive Files Shared Across Federal Property Agency

WASHINGTON — A 27 October 2026 audit of the U.S. General Services Administration (GSA) found 116 documents containing controlled unclassified information improperly shared with all users of the agency's Google Drive system. The inspector general said the files were accessible to employees and contractors without a legitimate need to see them. The finding concerns internal access controls; it does not establish that an outside attacker obtained the documents.

The audit, report A250043ITF27002, matters beyond the individual files. GSA manages federal property and procurement services, and its own estimate puts the number of documents in its Google Drive environment at roughly 2.5 million. Auditors identified the 116 files through a limited search, not a representative sample of the entire repository. Their count therefore cannot be extrapolated to claim that a particular percentage of all files was exposed.

The categories identified included personal information, material related to federal facilities, and confidential business records. Publishing the sensitive contents themselves is unnecessary to understand the oversight failure. The watchdog attributed the improper sharing to weaknesses in oversight of the agency's data-loss-prevention system and its rules for sharing protected material. Among the administrative shortcomings, the audit described incomplete review of detection criteria and missing approval procedures for sharing sensitive records broadly.

This is not the first warning. The inspector general's public summary traces concerns about the agency's handling of sensitive cloud-hosted information to 2014, with additional reports in subsequent years and an alert in April 2025. The recurrence raises a specific accountability question: why did earlier warnings not result in controls that prevented the latest improper access permissions?

The agency disputes any implication of an external breach. In a response reported by Nextgov/FCW, GSA Chief Information Officer David Shive said the agency's own review found that the identified documents were not exposed externally and found no indication of malicious intent. He said GSA had strengthened internal procedures, restricted access where appropriate and adopted an optical-character-recognition capability. Those are the agency's reported corrective actions, not independent proof that every affected document has been secured.

The inspector general recommended seven areas of action, including restricting access to the identified files, searching for additional improperly shared records, notifying affected people when required by policy and improving approval, training and monitoring procedures. The CIO agreed with the recommendations. Public oversight now turns on whether implementation can be tested and whether affected individuals are notified as required, rather than merely whether the agency accepts the findings.

The evidence supports a documented internal information-governance failure and an official response. It does not prove external disclosure, identity theft, malicious access or continuing exposure after the agency's reported changes. Those distinctions matter for the people whose information was involved, contractors whose business material may have been accessible and the public institutions relying on the agency's protection of sensitive records.