Date saved: 2026-10-20 11:00 (PDT)
Sources: SecurityWeek, Nextgov, BleepingComputer, The Hacker News, CISA
The Defense Manpower Data Center kept unencrypted Social Security numbers, dates of birth and military records for roughly 3 million people on a file-sharing server that unauthorized users could reach, and nobody inside the Pentagon noticed for about nine months. Access began in October 2025. The vulnerability was found on July 16, 2026 (SecurityWeek).
The people affected found out from a notification letter dated September 18, signed by DMDC Director Katie Griffin, not from any public announcement; Nextgov obtained the letter, and Military Times first reported it on September 24. The exposed population is 2.76 million living people and 294,000 deceased individuals, a defense official told CNN (SecurityWeek).
Nine months of unencrypted records
The data varied by person but could include Social Security numbers, names, dates of birth, contact details, demographic data and military occupational specialties, all stored unencrypted on a server inside an agency that holds more than 60 million records and helps manage identity for military personnel, government employees and contractors (BleepingComputer).
DMDC patched the flaw and restored the system after discovery, and is offering 12 months of free credit monitoring and identity restoration through IDX, with enrollment closing August 19, 2027 (BleepingComputer). The letter says the department has no indication the information has been misused.
The patch treadmill, and who it does not bind
The same pattern runs through this month's vulnerability disclosures. Cisco's Secure Firewall Management Center bugs are being exploited by three distinct threat clusters: one deploying JSP web shells to harvest credentials (UAT-12197), one carrying a variant of the Sandworm-linked Cyclops Blink implant (UAT-11823), and one using the low-privilege flaw for initial access before deploying Qilin ransomware (UAT-11988) (The Hacker News, September 11). The FMC is the console administrators use to configure the firewalls themselves: in each case the device whose job is watching the network was the way in.
CVE-2026-20079 scores a maximum 10.0 and hands an unauthenticated remote attacker root access (NVD). Cisco first published the advisory on March 4, 2026, and only revised it on September 9 to say active exploitation had been observed since August (Severity Daily). CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three-day deadline of September 12, a deadline that binds federal agencies only (CISA KEV catalog). Its partner flaw, CVE-2026-20316, had already been added in late July. Everyone outside the federal estate patches on Cisco's timetable, not CISA's.
Kept adding since: a FortiMail path traversal bug, CVE-2026-104286 (October 1), two Zammad flaws, CVE-2026-102489 and CVE-2026-102490 (October 2), and a Citrix NetScaler bug, CVE-2026-88779 (October 4) (weekly KEV update).
What the official story leaves out
"At this time, DoW does not have any indications of misuse of the accessed information" is a statement by the agency that failed to detect the access for nine months (SecurityWeek). A notification letter cannot see criminal use of Social Security numbers traded outside its systems, and credit monitoring detects fraud after it is already underway rather than preventing it.
Likewise, DMDC's assurance that it followed Office of Management and Budget and department guidelines describes a checklist, not an outcome: every control it complied with was in place while the exposure ran from October 2025 to July 2026. And the binding deadlines in this story apply to federal agencies. Everyone else (hospitals, schools, the businesses that hold your records) depends on a vendor deciding when to tell you, as Cisco's six-month gap between advisory and exploitation notice shows.
What readers can do
- If you served, or are a military family member: find the DMDC letter dated September 18 and enroll in the IDX monitoring offer before August 19, 2027, the window closes whether or not you have seen fraud yet.
- Freeze your credit with all three bureaus using the FTC's steps at identitytheft.gov; a freeze stops new accounts being opened in your name, which monitoring does not.
- Request an IRS Identity Protection PIN at irs.gov, an SSN alone is no longer enough to file a fraudulent return in your name.
- If you run a Cisco Secure FMC: apply the hotfixes for CVE-2026-20079 and CVE-2026-20316 now. Cisco states there are no workarounds (Cisco advisory).
- If you run FortiMail, Zammad or Citrix NetScaler: check the KEV catalog against your inventory; those three additions are from the first week of October.
Source links
- SecurityWeek - Pentagon Personnel Agency Data Breach Impacts 3 Million People
- Nextgov - Pentagon personnel breach undetected for months renews cyber standard scrutiny
- BleepingComputer - Hackers stole Pentagon personnel records of over 3 million people
- The Hacker News - Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
- NVD - CVE-2026-20079
- Cisco - Secure FMC Authentication Bypass Advisory
- CISA - Known Exploited Vulnerabilities Catalog
- Severity Daily - Cisco FMC exploitation confirmed, KEV due September 12