The Department of Defense is notifying 2.8 million living current and former military members that their personnel records were stolen during a network compromise lasting more than a month. The breach targeted a system operated by the Defense Manpower Data Center, the entity responsible for collating Department of Defense personnel records. Hackers gained access to this system starting in October.
A notification letter posted to Reddit indicates the stolen data includes Social Security numbers, names, addresses, sex, race, and occupational specialty. The inclusion of occupational data is significant because it may assist foreign intelligence agencies in identifying high-value military personnel. This incident marks the second major recent breach to expose sensitive US government personnel records.
Last month, the ransomware group ShinyHunters claimed it hacked FBI systems and stole records for thousands of current or former employees. According to Reuters, the job titles in those records included positions related to investigating China or Russia. Both incidents highlight a pattern of sensitive government data becoming available to criminal groups and foreign adversaries.