Pentagon breach exposes the job specialties of 2.8 million current and former personnel

Somebody posted a Defense Manpower Data Center breach notice to Reddit. Both Ars Technica and TechCrunch cite that post for what was taken and how ^[2][3]. The office that sent the notice calls itself the military's "leading identity management provider." It ties service members, employees and contractors to the smart cards and passwords that open Pentagon computer systems, buildings and bases ^[7]. It also holds more than 60 million records used to settle benefits such as healthcare and retirement ^[6].

"We make sure that the right people get access and the wrong people don't: security of identity information is paramount," the DMDC's website reads ^[8]. The notice says the stolen personnel records were unencrypted ^[4]. Nobody knows who took them ^[10]. Neither outlet reports that credentials were among the stolen fields, or that anyone has used the data against the people in it ^[20].

The US military had 1.3 million active service members as of March ^[16]. Suppose every one of them is among the 2.8 million living people in the file ^[1]. That still leaves at least 1.5 million who are not on active duty ^[2]. I'd expect many of them to work for civilian employers who were never sent a notice.

According to TechCrunch, the FBI theft has been called a "counterintelligence disaster" ^[13]. The fear is that a foreign government could use the data to target employees or pressure them into handing over sensitive information ^[13]. This week an FBI official called on ShinyHunters members to turn themselves in ^[14]. Personnel files have been an intelligence target for at least a decade. The 2015 breach of the Office of Personnel Management, broadly attributed to China, took the records of more than 22 million government employees, many of them with security clearances ^[15].

If you have to act on this on Monday, the decision comes down to two facts about your own organization. The first is whether any of your processes accept a Social Security number, birth date or home address as proof that a caller or applicant is who they say they are. The second is whether you employ or serve people whose role or clearance would make them worth approaching. Where both are true, add a verification step that does not depend on those fields. Then tell the people involved that a stranger who knows their service history has proved nothing about who he is. If you have the verification problem but no sensitive roles, it is a fraud problem, and the fix goes in the help-desk script. Sensitive roles without the verification problem make it a counterintelligence problem: brief those people and give them a place to report any contact. Where neither is true, the individual letters are the whole job.