Intruders sat in a Pentagon HR records server from October to July. Social Security numbers were exposed, and the data wasn't encrypted.

Picture this: the county records office leaves a side door unlatched in October, nobody notices until July, and the filing cabinets inside weren't locked either. CNN reports that "unauthorized users" got into a vulnerable server belonging to the Defense Manpower Data Center, the Pentagon's vast HR system, beginning last October, and the Pentagon didn't discover and fix the problem until July, according to a letter the center sent to victims. The breach exposed Social Security numbers and other personal information of current and former military personnel. The center held at least 60 million records as of fiscal 2024, according to its website. It's unclear how many were affected, though Military Times has reported that four million Department of Defense personnel could be. The letter says the stolen data wasn't encrypted, a standard security practice, and that in some cases it included a service member's "occupational specialty," which combined with other datasets could give foreign adversaries a clearer read on who does what for the military. The Pentagon says it "does not have any indications of misuse" of the data and is offering victims a year of credit monitoring. Justin Sherman, CEO of the advisory firm Global Cyber Strategies, warned a bad actor could use such data to "learn about or even target [defense personnel] based on their earnings, debts, marriages, spending habits, browsing activities, and worse." It's unclear who was behind the breach, and a Pentagon spokesperson did not immediately respond to CNN's questions. My take: nine months is a long time to leave a door open, and seeing no sign of misuse is not the same thing as no misuse. If you or someone in your family has served, watch for that letter and sign up for the monitoring, consider a free credit freeze at all three bureaus, and be wary of any call or message that seems to know a little too much about your service.