Pentagon breach: unencrypted SSNs sat in a file share for 9 months

For roughly nine months, a small number of unauthorized users had access to files on a Defense Manpower Data Center (DMDC) server holding unencrypted Social Security numbers. According to the breach notification letter reviewed by Military Times, that access ran from October 2025 until DMDC found a vulnerability in its file-sharing system on July 16, 2026. A Department of War official told CNN the breach affects 2.76 million living people plus 294,000 who have died, as SecurityWeek reported.

If you're a service member or veteran opening one of those letters this month, this is an unsettling week. For the security leaders reading along, the hard part is how ordinary the root cause looks.

DMDC maintains personnel records for the Department of Defense. Military Times reports that the agency's website lists more than 60 million records covering military and civilian personnel, contractors, family members, retirees and veterans.

The letter says the exposed files held Social Security numbers alongside names and, depending on the person, details such as date of birth or military occupational specialty. SecurityWeek notes that the letter doesn't name the file-sharing product or describe the flaw. DMDC has patched the system. It's offering affected people a year of credit monitoring and says it has no indication the data has been misused.

Most security teams will recognize this pattern. File-sharing systems exist to move data between people and teams. Over time they also become places where data stays.

An export lands on a share for a one-off task. The task ends but the file doesn't leave. Nobody owns it. Nobody classifies it. It sits in plain text until someone with the wrong access finds it.

Patching the vulnerability closes one route in. The bigger question is what sat behind it. Could anyone have answered that before July 16?

Nine months sounds extreme. In practice it's a familiar timeline, because reading a file looks like normal use. If the security team doesn't know a file holds Social Security numbers, there's little reason for that read to stand out.

For enterprise CISOs the takeaway is practical. You can't spot unusual access to sensitive data you haven't found yet. Discovery comes first and detection depends on it.

Some discovery tools scan only a sample of files to keep the workload down. Often they read just part of each file they pick. On a busy file share, the one-off export holding thousands of Social Security numbers is exactly the file a sample can skip. MIND scans every file in full in the locations that carry the most risk, so the answer doesn't depend on which files happened to get picked.

It shouldn't take a breach notification to learn what's on your file shares. Of course you have sensitive data. You're running a business. The goal is to know where it lives so you can keep it where it belongs.

MIND connects to the places sensitive data piles up, including on-premise file shares, SaaS apps, endpoints and email. Multi-layer AI classification reads content and context together. A spreadsheet of Social Security numbers is recognized for what it is, whatever the file happens to be called.

From there MIND surfaces risky exposure and helps your team fix it by removing public links, tightening permissions or escalating to the data owner. We think of this as minding the corners of your environment nobody has looked at in a while. The data in them becomes known and owned again. Because the work runs on AI rather than headcount, one person can keep that picture current.

Start with three questions about your own environment.

• Which file shares hold personal data like Social Security numbers?
• Who can reach those shares today?
• Which of those files still have a reason to exist?

If those answers take weeks to assemble, that's worth knowing now. Book a demo to see what MIND finds on your file shares. Most teams see their first results the same day they connect. That's Stress Free DLP.

Let's mind what matters.