Pentagon Personnel Agency Data Breach Impacts 3 Million People

The Defense Manpower Data Center left a file-sharing server containing unencrypted PII accessible to unauthorized users for approximately nine months, exposing Social Security numbers, dates of birth, and other sensitive details for nearly 3 million individuals. The dual failures of storing sensitive data in plaintext and allowing unauthorized access to persist undetected for such an extended period represent fundamental breakdowns in both data protection and monitoring practices. The sensitivity of this data — tied to military personnel and their families — makes it a high-value target for foreign adversaries and identity thieves alike. This breach underscores that government agencies handling sensitive national security data must enforce encryption at rest as a non-negotiable baseline control, and that prolonged unauthorized access without detection signals a critical gap in continuous monitoring capabilities.