Unauthorized users accessed a Pentagon HR server from last October until its discovery in July. Social Security numbers and other personal data of current and former military personnel were exposed; the number affected is unknown. The Pentagon reports no signs of misuse.
The server belonged to the Defense Manpower Data Center (DMDC), which maintained at least 60 million records as of fiscal 2024. The number affected is unknown; Military Times reported that 4 million Department of Defense personnel could be affected. The breach notice said the stolen data was unencrypted and, in some cases, included service members’ occupational specialties.
Experts said the information, if acquired by a foreign adversary or cybercriminal and combined with commercial datasets, could enable profiling, targeting, phishing or extortion. The breach letter said the Pentagon was assessing and strengthening DMDC cybersecurity and offered victims one year of credit monitoring. Those behind the breach have not been identified.
