Nine months.
That is the number that keeps me up at night. Somebody walked in and out of one of the Pentagon’s most sensitive systems for nine months, and nobody noticed. Nine months without a single alarm.
The system belongs to the Defense Manpower Data Center, the agency that verifies the identity of anyone carrying a Department of Defense card. It keeps the records of more than 60 million people: troops, veterans, civilian employees, contractors, family members. From October 2025 to July 2026, a small number of unauthorized users had access to a file-sharing server inside that system. The DMDC found out on 16 July 2026, almost by accident, when somebody stumbled on the vulnerability, and patched it right away.
By then the damage was done. 2.76 million living people and 294,000 dead ones had their data exposed. Names, dates of birth, contact details, military specialties, and Social Security numbers. In the clear.
And here is the part that should make you angry. Those 2.76 million people never signed up for this. A soldier does not fill in that form because he trusts the system. He fills it in because he has to. Trust was never a choice for him. It was the price of wearing the uniform.
Forget the movie version before it takes hold. There was no evil genius, no exotic zero-day, no code name. A vulnerability in a file-sharing system, a handful of “unauthorized users” (that is literally how the notice words it), and a server whose traffic nobody was reading. The intrusion was silent. And silent is worse than sophisticated, because sophistication you fight with money and talent, while silence you can only fight by looking. Nobody was looking. That is the whole story.
Nine months of silent access, and we still do not know who did it. No known group has claimed it. Sit with that for a second. In this business, whoever does not sign the job is usually whoever does not need the publicity. A state, organised crime, or somebody with legitimate access who went too far. Pick your poison.
Now, the part almost nobody explains, and it is where the real lesson lives. Two things get confused all the time, and the confusion is expensive. There is the perimeter, and there is the data. The perimeter is the building door, the firewall, the VPN, the access control. The data is what sits inside. We are very good at the first one. We barely think about the second. But a server holding millions of records in the clear is an open box sitting inside a guarded building. If somebody gets past the door, there is nothing left to force. They just copy.
And nobody was watching for the copy. That is the detail that hurts. There is no alarm that rings when millions of records leave a server. Nobody budgets for encryption at rest, access logging, exfiltration alerts, log retention. Those words do not make it into the slide with the big numbers. They are boring, and boring does not sell. So here is the question nobody asks: if they get in, what do they take, and how long until we notice? The answer this time was everything, and nine months.
And for the record, this is what good looks like, and it is not glamorous. You encrypt the data at rest, so a copied file is worth nothing. You log every access, so you can see who touched what and when. You set alerts for abnormal volume, so a bulk export screams instead of whispering. And you give every account the least privilege it needs, so the password of the database is not the database password. None of that takes a good photo. All of it is what keeps three million people out of a headline.
Why does this keep happening?
Because watching the data is boring. It does not make the budget with a photo op. It does not win elections. It does not impress anyone at a press conference. Money goes to offensive capability and deterrence, which is the part you can show. Constant monitoring is invisible until the day it fails, and when it fails, it fails quietly. No bang. No red screen. No headline. Just nine months of silence.
And that comes down to incentives. The guy who buys the flashy thing can show you the invoice and the contract. The guy who protects the data can only show you what did not happen, and you cannot hang that on a wall. Doing security well looks like nothing happening. So the budget goes to the cannons, and the cameras wait.
Now ask yourself the uncomfortable question. If this happens at the institution with the biggest cyber-defence budget on the planet, in a system with 60 million records, how many doors like this are open right now where there is less money and far less scrutiny? I can answer that one from experience.
Back in 2006 I was still working in cybersecurity. We were securing a Solaris machine in the DMZ of a data centre belonging to one of the biggest companies in Spain. An Oracle server, exposed. Which is bad enough on its own. And it got worse: you could reach it over SSH, on port 22, with the username “oracle” and the password “oracle”. The company had spent a fortune on Check Point firewalls, on training, on certifications, on top-of-the-range hardware. And the worst part came afterwards: nobody knew that server existed. All their inventory had for it was an IP address, and an IP address tells you nothing about what is actually running behind it. We got lucky. One script kiddie found it, he had no idea what Solaris was, and the exploit he tried to run was built for Linux. That is the only reason we are not telling a different story.
Almost twenty years later, nothing has changed. An expensive perimeter on one side, and on the other a machine running exposed for who knows how long without anyone knowing it was there. You secure the things you can see. The things you cannot see are the ones that get you. Are we afraid of artificial intelligence? I am not. What this world needs is a bit of intelligence.
Back to the Pentagon. They have not answered the questions that matter. Who got in, whether it was deliberate, whether the victims belong to one particular group, and the big one: why personal information was sitting on a server with no encryption. When the easy answers come fast and the hard one gets postponed, the hard one is usually the answer.
And then there is the detail almost nobody has looked at, the one I cannot get out of my head. The leak splits the dead from the living. 294,000 of those records belong to people who are no longer here. For an intelligence service, those records are worth something different. The living are targets. The dead are cover. A dead person’s identity, reused, sails through automated checks for years, because nobody expects a dead man to ask for credit. So they are still working for somebody, and they have no idea.
Think about what this means if you are one of the living. Your name, your date of birth and your Social Security number are enough to open an account, take out a loan or pass an automated check. That is the whole toolkit of identity theft, and it was handed over in a single file. And you cannot change it. A password you can change. Your Social Security number you cannot.
So what was the official response to exposing millions of people? Twelve months of credit monitoring, contracted with IDX for those affected.
Read that again. We failed you, and now it is on you to watch whether somebody uses your identity. The problem got moved onto the victim, and the person who trusted is now doing the work the institution did not do.
They will promise to harden the perimeter, hire more cyber-defence and learn the lesson. The real lesson is the one that says the data and its monitoring are the asset, and the building is just the wrapper. That lesson is still waiting its turn. Meanwhile, the people who were inside the system because they had to be will keep paying the bill for a priority that was never theirs.
Nine months looking the other way. And now twelve months watching you.
A version of this text also lives on my personal blog: sancholerena.com.