From .MIL to .ML: How a Typo Led to a Major Security Breach

In the ever-evolving landscape of cyberspace, a minor oversight can yield catastrophic outcomes. Today, we embark on a riveting journey to uncover how a seemingly innocent typo in a domain name triggered a significant security breach, inadvertently exposing millions of classified US military emails to unintended recipients. This fateful error redirected sensitive information to a company managing Mali’s .ML domain, subsequently posing alarming concerns as Mali remains under the influence of a Russian-backed military government. Join us as we delve into the intricate tale of this typographical error and its profound implications.

The .MIL to .ML Mix-up:

At the core of this incident lies a critical confusion between the .MIL and .ML domain suffixes. The former, reserved exclusively for US military email addresses, holds highly sensitive information related to national security. The latter, representing Mali’s country identifier, was inadvertently used due to typographical errors when sending emails.

Unveiling the Consequences:

The unintentional redirection of countless Pentagon emails to the .ML domain exposed an alarming array of confidential information. Among the leaked data were diplomatic documents, tax returns, passwords, and detailed travel itineraries of senior officers. As these emails poured into the wrong hands, the potential implications on US military operations and national security became a grave concern.

A Long-standing Vulnerability:

Remarkably, this typo-induced security vulnerability had remained unnoticed for an extended period. Despite experts warning about the possibility of such errors over a decade ago, the oversight continued to evade detection. It took this dramatic incident to expose the magnitude of this endemic mistake and its potential ramifications.

Mali’s Alliance Shift:

Compounding the gravity of the situation is Mali’s shift in alliances. Since the 2020 toppling of its elected president, Mali has veered away from its western allies, embracing closer ties with Russia. As control of the .ML domain falls back into the hands of Mali’s government, the risk of adversaries exploiting the misdirected emails looms larger than ever.

The Crusade of a Domain Manager:

In the center of this unfolding saga stands Johannes Zuurbier, the CEO of the tech firm managing Mali’s domain. In 2013, Zuurbier began noticing an influx of requests for non-existent domains, raising suspicion about potential security breaches. Taking proactive measures, he diligently collected close to 117,000 misdirected messages, revealing the depth of the problem. His persistent attempts to communicate the issue to US officials highlight the urgency of addressing this oversight.

Lessons Learned:

This alarming security breach serves as a poignant reminder of the critical need for robust cybersecurity measures and continuous vigilance. It emphasizes the importance of thoroughly verifying domain names and underscores the far-reaching consequences of even the smallest mistakes.

The tale of how a single typo led to a major security breach, exposing classified US military emails to unintended recipients in Mali, is a cautionary tale for the interconnected world of cyberspace. It prompts a collective call to action, urging all stakeholders to bolster their defenses against such inadvertent vulnerabilities. As the digital landscape evolves, it is imperative to stay vigilant and proactive in safeguarding sensitive information, for the smallest oversight can unleash catastrophic repercussions on national security and international relations.


  1. Richard Wilson Avatar
    Richard Wilson

    In a rush, a US military contractor made a typo, using “.ml” instead of “.mil” in email addresses. “.ml” is Mali’s domain managed by a non-malicious company. Classified US military emails were sent there, causing a major security breach. Lessons learned: Attention to detail is crucial in cybersecurity.

  2. David Blake Avatar
    David Blake

    A simple typo from .MIL to .ML resulted in a major security breach, highlighting the importance of attention to detail in cybersecurity. Such errors can have significant consequences, emphasizing the need for rigorous verification protocols and continuous training to safeguard sensitive information and systems. Vigilant cyber practices are essential in the ever-changing digital landscape.

Join the Discussion

Discover more from Domain Magazine

Subscribe now to keep reading and get access to the full archive.

Continue reading

Verified by ExactMetrics