Pentagon breach exposed about 3 million people's records: who's affected and what to do
A Pentagon records agency exposed names, Social Security numbers and birth dates of about 3 million people over nine months. What's confirmed, and what to do.
Stated by the maker, publisher, or platform holder.
The Pentagon has confirmed that personal records for more than 3 million people were exposed in a breach of the Defense Manpower Data Center, the agency that keeps personnel records for the US military. The data includes Social Security numbers.
Military Times reported it on 24 September. Pentagon officials have since confirmed it to several outlets, and affected people are receiving notification letters.
What's confirmed
What isn't known
Officials declined to say who was behind it, whether the access was targeted, or why unencrypted personal data was reachable on that system. Nine months of access before anyone noticed is the part that will get the most scrutiny.
If you might be affected
If you've served, worked for the Defense Department, or are a military family member, watch for a letter. Then:
- Enrol in the IDX credit monitoring offered in the letter.
- Freeze your credit with Equifax, Experian, and TransUnion. It's free, and it makes it much harder for anyone to open new credit in your name.
- Be wary of calls, texts, and emails that mention your service record. Exposed data like this is often used to make scams sound official.
Active-duty service members and National Guard members can also get free electronic credit monitoring.
The bigger picture
This lands in the same week that a hacking group claimed it stole data on FBI agents and job applicants, and the same week we covered the Gyazo breach. Government systems holding decades of personnel records are as exposed as any company's, and a Social Security number, unlike a password, can't be changed.