There was a report in the beginning of June that things started looking weird. The registration of new .ml domains shut down in the beginning of the year.

In short, the Mali government just gave some random 3rd party a ten-year contract to hand out the domains for free, which the third party did without too much care or attention. It would have been up to the third party to notify domain owners, but as they're not paying and probably don't even have contracts themselves, there was little incentive to do so.

As far as I can understand, it relates to the US military scandal only indirectly: As the .ml domains are now returning to the government of Mali, it becomes a lot more problematic that the US keep directing their emails there, and the person in charge of managing the domain went public about the security threat.