- Hackers had access to Pentagon files for 9 months.
- The files hold data on about 3 million people.
- Social Security numbers in the files weren't encrypted.
- Letters offer a free year of credit monitoring.
If you or your family served in the military or worked for the Pentagon, hackers may have your Social Security number. Here's how to find out.
The Pentagon is mailing letters to the people whose data the hackers could see. If you get one, the hackers could see your Social Security number. The letter offers a free year of credit monitoring through IDX, a company that the Pentagon hired. You have until August 19, 2027, to sign up.
Military Times breach letter report, BleepingComputer on the sign-up deadline
The hackers got in through a security hole in a Pentagon file-sharing system. They could open the files for nine months. The Pentagon found the hole in July and says it fixed it right away. The Pentagon hasn't said who the hackers were.
The files belong to the Defense Manpower Data Center, the Pentagon office that keeps records on people tied to the military. That means troops, veterans, civilian workers, contractors and their families. The files hold data on about 3 million people. Along with Social Security numbers, the hackers could see things like names, birth dates and military jobs. None of it was encrypted, so anyone who opened the files could read it.
To sign up for IDX, you give your name, address, phone and email, but not your Social Security number. You can also freeze your credit for free. A freeze stops anyone, you included, from opening new credit in your name until you lift it. If your credit is already frozen, you'd have to lift the freeze for a while to start the IDX monitoring service.
FTC credit freeze guidance, IDX DMDC enrollment help page
Defense officials say they've seen no sign so far that anyone has misused the data. But security experts worry that the military job details could help foreign spies learn who does what in the US military.
