Pentagon Warns Millions of Service Members After Months-Long Data Breach

The U.S. Department of Defense has started telling millions of current and former military personnel that hackers stole their personal information, in an intrusion that stretched over several months before it was contained.

Notification letters are going out to affected service members and veterans. The scale is what makes the incident stand out. Records covering millions of people sit in the stolen data, making it one of the larger breaches to touch the American armed forces in recent years.

The duration is a central concern. A breach that runs for months suggests attackers had sustained, largely unnoticed access to the systems in question. Long dwell times typically give intruders the chance to map a network, locate valuable databases and copy data in bulk rather than in a single quick grab.

Personnel records are especially sensitive. Files of this kind can include names, Social Security numbers, dates of birth, contact details and service history. In the wrong hands, that information fuels identity theft and fraud, and it can also be used for targeted phishing or social engineering aimed at people with security clearances or access to sensitive work. For active-duty personnel and their families, the risks reach beyond finances.

Affected individuals should treat the notice as genuine but verify it through official channels rather than clicking links in unsolicited messages, since scammers often exploit breach announcements. Standard precautions apply: freeze or monitor credit reports, watch accounts for unfamiliar activity, use any free credit monitoring that is offered, and be wary of calls or emails claiming to come from the military or a benefits office.

The disclosure will likely draw scrutiny from lawmakers and cybersecurity specialists. Key questions include how the attackers got in, why detection took so long, and whether the affected systems were run by the department directly or by an outside contractor. Government data held by third-party vendors has been a recurring weak point in past incidents.

The breach is a reminder that even organizations with substantial security budgets struggle to spot patient, well-resourced intruders. For the people whose records were taken, the practical work of protecting their identities starts now.