Pentagon Data Breach Exposes Military Personnel Data, Raising Counterintelligence Concerns
A data breach at the Pentagon’s sprawling human resources system has exposed Social Security numbers and other personal information belonging to current and former military personnel, according to a letter sent to victims and reviewed by CNN. The incident is fueling counterintelligence concerns among national security experts, who warn that the compromised records could help foreign governments identify and track U.S. service members.
Unauthorized users accessed a vulnerable computer server belonging to the Defense Manpower Data Center, or DMDC, beginning last October, the letter says. But the Pentagon did not discover and remediate the problem until July—about nine months later. The letter is dated this month.
The DMDC held at least 60 million records as of fiscal 2024, according to its website. It is unclear how many records were affected, but Military Times reported that as many as 4 million Department of Defense personnel could be impacted.
The Pentagon currently “does not have any indications of misuse” of the breached data, according to the letter. Even so, experts say the stolen information could be a goldmine for foreign intelligence services seeking to track U.S. military personnel, or for cybercriminals who might try to extort them if they obtain the data.
In some cases, the intruders accessed the “occupational specialty” of military service members, the letter says. When combined with other datasets that use identifiers such as Social Security numbers, that detail could give foreign adversaries a clearer picture of who does what for the U.S. military in different parts of the world.
It is unclear who was behind the breach. A Pentagon spokesperson did not immediately respond to CNN’s questions, including about the culprit.
The disclosure comes amid heightened warnings from U.S. military leaders that troops’ phones and online accounts could be targets during the war with Iran. U.S. Central Command, which covers the Middle East and beyond, told lawmakers in the spring that it had “received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater.”
Justin Sherman, CEO of the advisory firm Global Cyber Strategies and author of an upcoming book on the data broker industry, said a malicious actor could pair the DMDC data with other commercial datasets to “learn about or even target [defense personnel] based on their earnings, debts, marriages, spending habits, browsing activities, and worse.”
According to its website, the DMDC is “the one, central access point” for information on Department of Defense entitlements, benefits and “medical readiness” for military personnel, veterans and their families. The center says the services and data access it provides support many vital government entities, “including the legislative branch, human services, national defense, labor, healthcare, finance, veterans affairs, research, and more.”
The stolen data was not encrypted, according to the letter. Encrypting sensitive data is a standard security practice. The letter says the Pentagon is “taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system” and is offering victims a year of credit monitoring services.
“On its own, having personal data on potentially millions of service members exposed is dangerous as the U.S. wages war on Iran and is in competition with multiple other governments,” Sherman told CNN. “If a foreign adversary was to get this kind of data trove, it could enable phishing, profiling, foreign intel approaches, and much more.”
The breach highlights the growing risk posed by the federal government’s reliance on large, interconnected personnel databases—and the value of the personal data they hold. For service members, even basic identifiers can become leverage in the hands of a foreign intelligence service or criminal network. The nine-month gap between initial access and remediation also raises questions about how quickly agencies can detect intrusions into systems that store some of the government’s most sensitive workforce data.
For more CNN news and newsletters create an account at CNN.com