Pentagon data breach exposed data on more than 3 million people for nine months
The affected system was run by the Defense Manpower Data Center (DMDC), which manages personnel records across the military and much of the Defense Department's civilian workforce. Read Entire Article
A significant data breach at the Pentagon exposed the personally identifiable information of over 3 million individuals for a period of nearly nine months. The compromised system, managed by the Defense Manpower Data Center (DMDC), contained crucial data on both military and civilian personnel, including Social Security numbers and job information. This combination of data presents a heightened risk beyond standard identity theft.
The DMDC, responsible for maintaining personnel records for the entire military and Defense Department's civilian workforce, holds more than 60 million records. These records encompass active-duty troops, reservists, civilian employees, contractors, retirees, veterans, and military family members. Upon the breach's discovery, the DMDC promptly addressed the vulnerability.
However, several critical questions remain unanswered, such as the method used by the intruders, the specific vulnerability exploited, the extent of data viewed or copied, and the duration of the undetected breach.
The department has not disclosed the identity of the individuals or entities responsible for the intrusion. The nine-month lapse in detection underscores the challenges in securing such extensive personnel databases, which are inherently complex systems used across multiple functions like payroll, benefits, and workforce records. This complexity can facilitate unauthorized access across multiple groups simultaneously.
While the Pentagon has not found evidence of misuse of the exposed data, the presence of permanent identifiers like Social Security numbers raises ongoing risks. The department has offered identity protection and credit monitoring services to those affected. Nonetheless, the lack of confirmed misuse does not preclude the data from being at risk of future exploitation, as it can be retained, traded, or combined with other information long after an incident is publicly known.
The Pentagon's breach follows a separate incident involving FBIJobs.gov, the FBI's employment website. The FBI has alerted all employees regarding potential compromise of their personal information. The FBI stated that the affected system was unclassified and advised employees to remain vigilant against suspicious communications.
The hacking group ShinyHunters subsequently claimed to possess FBI-related data but insisted it would not release the information, describing the breach as a marketing campaign intended to protect their business and combat disinformation. The Pentagon's immediate response was to emphasize that the incident is not extortion, ransom, or financially motivated.
The larger concern for the Pentagon now lies in determining the full extent of the unauthorized access during the nine-month period and assessing whether any data was copied or used illicitly.
Written by urgent.news from TechSpot's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
