[nonameiguess]

Any e-mails with PII or other information considered sensitive is supposed to be encrypted, which is at least one reason contractors get CACs and .mil e-mails of their own, so they're able to send encrypted e-mails.

Given what can be figured out by collecting thousands of hotel itineraries or whatever is actually being leaked here, it may just be the DoD needs to crack down and expand the definition of what is considered sensitive.