The Pentagon is notifying more than two million current and former military members that their personal data was stolen in a months-long breach of a Defense Department network. The compromised system, run by the Defense Manpower Data Center, holds personnel records; the breach affected 2.8 million living individuals. The intrusion began last October.
Stolen records include Social Security numbers, names, addresses, sex, race, and occupational specialty. The occupational data is especially concerning because it could help foreign intelligence agencies identify high-value military personnel. The Defense Manpower Data Center says it handles more than 60 million personnel records for military, civilian, contractor, retiree, and veteran personnel and their families.
This is the second major federal personnel-data breach in recent months. Earlier, the ransomware group ShinyHunters claimed to have hacked FBI systems and stolen records of thousands of employees. The group said it won't release the data, but the source notes such promises from a criminal organization are unreliable. An FBI official urged members to surrender after Dutch police arrested one.
The Pentagon has not explained how the attackers breached its systems, whether it has been in contact with them, or whether ransom demands were made. Officials say the stolen data has not been misused, but have not detailed how they know that. Together, the two incidents are described as one of the largest potential espionage hauls since the 2015 Office of Personnel Management breach.