The Pentagon Lost 3 Million Records in Nine Months of Silence
The Pentagon just confirmed what every CISO quietly fears. Hackers had access to the Defense Manpower Data Center for nine months. Not nine hours. Nine months. And nobody noticed.
Between October 2025 and July 16, 2026, a small number of unauthorized users sat inside a file-sharing system that holds the personal records of US military personnel. When the Pentagon finally found the vulnerability and patched it, the damage was already done: roughly 3 million people exposed. That is 2.76 million living people and another 294,000 deceased individuals. The files held Social Security numbers, names, birth dates, contact details, race, sex, and military occupational specialties. None of it was encrypted.
Let that sink in. Unencrypted SSNs on a network-accessible file-sharing server, at the Pentagon.
The headline is not the number. It is the silence.
Three million is a big number, but the number is not the story. The story is that this went on for nine months. The DMDC is the Pentagon’s central identity repository. It manages around 60 million records covering service members, civilian employees, contractors, retirees, veterans, and families. If a facility like that can go nine months without detecting unauthorized access, every organization should be asking one uncomfortable question: would we know?
The Pentagon says it has seen no evidence of misuse. That is not the same as no misuse. Nine months is enough time to exfiltrate, organize, and monetize data many times over. One identity theft specialist I would agree with put it bluntly: months of unauthorized access going undetected is the real warning.
This is OPM all over again
The comparisons to the 2015 OPM breach are fair. That breach also went undetected for months and exposed background investigation records of millions of federal employees. A decade later, the same failure mode shows up again: a critical system, sensitive data, no encryption, and detection measured in quarters instead of minutes.
The Pentagon offered affected individuals 12 months of credit monitoring through IDX, with enrollment open until August 19, 2027. That is the standard playbook. It does not fix the root causes.
What CISOs should take from this
Three lessons, none of them comfortable.
First, encryption at rest is not a best practice. It is table stakes. Storing unencrypted SSNs on a file-sharing system in 2026 is negligence wearing a compliance badge.
Second, dwell time is the metric that matters. Your threat actors do not care about your perimeter. They care about how long they can live inside before someone asks who they are. If your answer is measured in months, you have an incident you have not discovered yet.
Third, breach notification is damage control, not strategy. Credit monitoring after the fact is fine. It is not security. Security is knowing who touched what, when, and being able to prove it.
The question for your next board meeting
Ask your team: if someone exploited a vulnerability in one of our file-sharing systems today, how long before we would know? If the answer is not measured in hours, you have your top priority.
The Pentagon had the budget, the mandate, and the mission. It still lost nine months. Your advantage is that you can learn from their loss without paying for it.
About Author
