The Pentagon just told millions of people their personal data was stolen, and the hackers had months to do it.
The Department of Defense confirmed that hackers breached a system holding personnel records and extracted data on millions of current and former U.S. military members. The intrusion ran for months before it was discovered, according to DoD's notification to affected individuals. The agency has not detailed which specific data fields were exposed or named the attackers. Notifications are only going out now, well after the breach itself occurred.
A breach this size puts a concentrated trove of personal information for service members, past and present, into unknown hands, raising real risks of identity theft and targeted scams against people who often hold active security clearances. The months-long dwell time is the real story here: attackers had enough time to be thorough, not just lucky.
It echoes the 2015 Office of Personnel Management breach, when hackers made off with security-clearance files on more than 20 million federal workers, a reminder that government HR systems remain a soft target a decade later.