What changed
The Pentagon is notifying more than 2 million current and former military members that hackers accessed a Defense Manpower Data Center system for months, exposing records belonging to 2.8 million living people.
The stolen fields included Social Security numbers, names, addresses, sex, race and occupational specialty. The intrusion began last October; officials have not said how the attackers got in, who they were or whether they demanded a ransom.
Why it matters
This is more than a large identity-theft problem. Occupational specialty can help foreign intelligence services identify high-value military personnel, giving an otherwise ordinary personnel database a potential espionage use.
The scale is also uncomfortable. The center holds more than 60 million Defense Department personnel records covering military and civilian workers, contractors, retirees, veterans and family members. A system holding that much information does not need every record stolen to create serious exposure.
The Pentagon says it has not seen evidence that the data was misused, but it has not explained how it reached that conclusion. That leaves the central risk unresolved: sensitive information can remain useful to an attacker long after a breach is discovered.
The incident follows last month’s claim by the ransomware group ShinyHunters that it stole records from thousands of current or former FBI employees, including job titles linked to investigations involving China or Russia. The FBI has urged members of the group to surrender, and Dutch police arrested one ShinyHunters member.
Taken together, the two breaches create a potentially valuable intelligence haul. The danger is not only what criminal hackers choose to publish. Nation-state intelligence services may also be able to obtain or exploit data that criminals keep private.
Comments
No comments yet.