Nine months is a long time to sit in someone's data unnoticed. Malwarebytes reports that the Pentagon is now notifying people whose records were taken from the Defense Manpower Data Center, with access running from October 2025 to July 2026. ABC News carried the same story under a headline of nearly three million people.
The numbers and the data
The Pentagon confirmed 2.76 million living individuals and 294,000 deceased individuals. Exposed fields include Social Security numbers, names, dates of birth, sex and race, and service details. Some records also had contact information and occupational specialty. DMDC holds around 60 million records overall, so this is a slice, but a slice of the sort that follows people for life.
How it happened, as far as anyone has said
According to the report, attackers exploited a vulnerability in an unspecified file-sharing system and reached a server holding unencrypted personal information. That is the whole public explanation. Two things stand out: the data was sitting in the clear, and the intruders were there for the best part of a year. Encryption at rest would not have stopped a compromised application, but it is a question the answer to which matters.
The "no indication" line
The Pentagon says it has no indication of misuse. Malwarebytes rightly notes the method behind that statement is not explained. Absence of evidence after a nine-month undetected window is thin comfort, and for a Social Security number it will stay thin for decades.
What it means for your estate
- List the file-transfer and sharing tools you run, including the ones attached to a legacy project. Are they patched and are they internet-facing?
- Find where unencrypted personal data lives on servers those tools can reach. Staging copies and exports count.
- Decide how long an intruder could sit in that data before you would notice. If the honest answer is "months", the monitoring is the gap.
- Prepare the notification process now: who is told, in what order, with what offer.
For affected individuals, the recommendations are practical: accept the free credit monitoring, freeze credit with all three bureaus, get an IRS Identity Protection PIN, and expect convincing phishing that uses the stolen details. If you would like help mapping where sensitive data sits behind your own file-sharing tools, email sales@halfteck.com.