|
A breach of the Pentagon's personnel database exposed sensitive information, including Social Security numbers and details about jobs held by military and civilian personnel, affecting nearly 3 million people, according to ABC News.
The breach affected 2.76 million living people and another 294,000 deceased individuals, a US defence official said. The scope of the exposed information has raised concerns because the records included details about the jobs performed by military and civilian personnel. "A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. Upon discovery, DMDC immediately remediated the vulnerability," the defence official said. The Defense Manpower Data Center is one of the Pentagon's main repositories for personnel records and holds information on active-duty and reserve troops, civilian employees, contractors, retirees, veterans and military family members. The agency maintains more than 60 million personnel records. The unauthorised access continued from October 2025 until July 2026, when DMDC discovered and patched the vulnerability. Defence officials said they have found no evidence so far that the exposed information has been misused and are offering identity protection and credit monitoring resources to affected individuals. The Pentagon breach comes as the FBI separately notified employees about a breach involving its jobs portal, [FBIJobs.gov]. An unidentified threat actor had said it would publish data including FBI employees' names, home addresses, personal and work contact information, Social Security numbers, dates of birth and emergency contact information, sources told ABC News. The FBI is operating as if every FBI employee's personal information was compromised. However, the hacking group "shinyhunters" later claimed in a statement to The New York Times and 404 Media that it would not release the data as previously threatened. ABC News said it had not independently verified the group's claims. Meanwhile CNN also reported that the Pentagon breach involved a vulnerable computer server belonging to the DMDC, with unauthorised users gaining access beginning in October 2025. A letter sent by the center to victims and reviewed by CNN said the issue was not discovered until July. CNN reported that one category of information accessed in some cases was the "occupational specialty" of military service members. The breached data was not encrypted, according to the letter. The Pentagon currently "does not have any indications of misuse" of the breached data, according to the letter reviewed by CNN. However, cybersecurity experts said the information could potentially be combined with other datasets to profile military personnel or facilitate phishing and intelligence-gathering efforts. Justin Sherman, CEO of advisory firm Global Cyber Strategies, told CNN that access to such information could enable profiling, phishing and foreign intelligence approaches if acquired by a foreign adversary. It remains unclear who was behind the breach. A Pentagon spokesperson did not immediately respond to CNN's questions about the culprit. The DMDC said it is taking appropriate actions to assess and enhance the cybersecurity of its system and is offering victims a year of credit monitoring services. The DMDC website highlights the centre as a central access point for information related to Department of Defense entitlements, benefits and medical readiness for military personnel, veterans and their families. (ANI)
|
