[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGzkD0w9Am5UI7oA3N7p8xpDH10bk42LJ5S0jyL3qefg":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"22dab517-b1a5-4e20-99be-486d3d5f0749","Pentagon Personnel Agency Data Breach Impacts 3 Million People","pentagon-personnel-agency-data-breach-impacts-3-million-people-afea0a","The data breach affects the Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense. The post Pentagon Personnel Agency Data Breach Impacts 3 Million People appeared first on SecurityWeek.","The US Defense Manpower Data Center (DMDC) has begun notifying individuals whose personal information was exposed in a data breach. Unauthorized users accessed a file-sharing server containing unencrypted Personally Identifiable Information (PII) for approximately nine months. The exposed data includes Social Security numbers, names, dates of birth, and other sensitive details for 2.76 million living and 294,000 deceased individuals.","Pentagon personnel data breach exposes personal information of 3 million people.","https:\u002F\u002Fwww.securityweek.com\u002Fpentagon-personnel-agency-data-breach-impacts-3-million-people\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002FPentagon.jpeg","2026-09-29T12:25:12+00:00","2026-09-29T14:00:33.217154+00:00",8,[17,20,23],{"name":18,"type":19},"DMDC file sharing system","product",{"name":21,"type":22},"Department of Defense","vendor",{"name":24,"type":22},"DMDC","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,18],{"controls":51,"vendors":135},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":82,"name":83,"problem":84,"products":85},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":104,"url":107,"description":108},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":110,"name":111,"problem":112,"products":113},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":123,"product_name":124,"url":125,"description":126},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":154},"pentagon-agency-exposes-3-million-records-on-unencrypted-file-sharing-server-for-nine-months","Pentagon Agency Exposes 3 Million Records on Unencrypted File-Sharing Server for Nine Months","The Defense Manpower Data Center left a file-sharing server containing unencrypted PII accessible to unauthorized users for approximately nine months, exposing Social Security numbers, dates of birth, and other sensitive details for nearly 3 million individuals. The dual failures of storing sensitive data in plaintext and allowing unauthorized access to persist undetected for such an extended period represent fundamental breakdowns in both data protection and monitoring practices. The sensitivity of this data — tied to military personnel and their families — makes it a high-value target for foreign adversaries and identity thieves alike. This breach underscores that government agencies handling sensitive national security data must enforce encryption at rest as a non-negotiable baseline control, and that prolonged unauthorized access without detection signals a critical gap in continuous monitoring capabilities.",[141,142,143,144,145,146,147,148,149,150,151,152,153],"NIST SP 800-53 SC-28 (Protection of Information at Rest)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 AU-6 (Audit Record Review, Analysis, and Reporting)","NIST SP 800-53 SI-4 (System Monitoring)","CIS Control 3 (Data Protection)","CIS Control 6 (Access Control Management)","CIS Control 8 (Audit Log Management)","CIS Control 13 (Network Monitoring and Defense)","GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 32 – Security of Processing","FISMA (Federal Information Security Modernization Act) – Continuous Monitoring","NIST CSF PR.DS-1 (Data-at-rest is protected)","NIST CSF DE.CM-1 (Network Monitoring)",{}]