Vulnerabilities
Pentagon Data Breach: Millions of SSNs and Military Records Exposed
The U.S. Department of Defense suffered a breach that exposed Social Security numbers and sensitive military personnel records for millions of individuals. The incident involved a compromised contractor system and highlights the need for stricter access controls, continuous monitoring, and incident response readiness. Defenders should review privileged access, enforce MFA, and conduct forensic analysis.
What Happened
A compromised contractor system used by the Department of Defense was infiltrated, allowing attackers to exfiltrate a database containing Social Security numbers, service records, and other personal data for millions of military personnel.
Impact
Millions of active and retired service members, their families, and contractors have had their SSNs and sensitive records exposed, increasing the risk of identity theft and targeted attacks on defense infrastructure.
Immediate Actions
- Verify and isolate the compromised system; block outbound traffic to known malicious IPs.
- Force password resets for all privileged accounts and enforce MFA.
- Run a full forensic scan of all connected devices for persistence mechanisms.
- Notify affected individuals and provide credit‑monitoring resources.
Long‑Term Measures
Implement zero‑trust segmentation for contractor access, conduct regular penetration testing of third‑party integrations, and enforce least‑privilege policies. Maintain an up‑to‑date inventory of all personnel data and apply data‑loss‑prevention controls.
Related vulnerabilities
Flock Camera Firmware Leak Exposes Unencrypted Key for ALPR Data
A captured Flock camera’s firmware was reverse‑engineered, revealing an unencrypted key that unlocks the device’s encrypted storage. The analysis shows the camera records millions of images and can detect people, vehicles, license plates, and even graphics such as bumper stickers. Defenders should verify key storage practices, update firmware, and monitor for anomalous image generation.
Read briefing
FBI Arrests ShinyHunters Operatives Following FBIjobs.gov Breach
The FBI detained three individuals linked to the ShinyHunters group after a breach of the FBIjobs.gov domain exposed sensitive employee data. The attack leveraged a known Oracle vulnerability and was traced to an unpatched Accenture contractor. Defenders should verify Oracle patch status, review access controls on recruitment portals, and monitor for similar data exfiltration patterns.
Read briefing
Florida DMV Driver Database Breach: Stolen Police Credentials Reveal Over 200k Records
The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after the ShinyHunters extortion gang claimed to have accessed the system using stolen police credentials. The attackers exploited a compromised account belonging to a Plant City Police Department employee, who stored the login on a personal device. While ShinyHunters alleged a password‑reset flaw and claimed more than 200,000 records were exfiltrated, FLHSMV has not confirmed the exact number of records accessed. The agency has notified state authorities, halted further intrusion, and i
Read briefing
DMDC File‑Sharing Server Breach Exposes 3 Million DoD Personnel Records
The Defense Manpower Data Center (DMDC) confirmed that a security flaw in its file‑sharing system allowed unauthorized users to read unencrypted personal data for roughly nine months. The breach, discovered in mid‑July 2026, exposed PII for about 3 million Department of Defense personnel. Defenders should verify DMDC system patches, monitor for suspicious activity, and review access controls on file‑sharing services.
Read briefing