The OPM breach should have taught one lesson, and it was never about China being good at hacking. Everyone already knows China is good at hacking. OPM matters because it shows exactly how the federal government loses its people’s data, and the way it happens is humiliating for everyone involved.
A records warehouse stuffed with unencrypted personally identifiable information. Access controls soft enough for someone to walk in with stolen credentials and stay the better part of a year. Nobody watched the inside closely enough to notice.
The hack looked sophisticated at the edges yet ran rather lazy at the core, because it never needed to be anything more. It was easy to pull off. The government lecturing every state and local government, bank, contractor, and hospital on cyber security could not adequately secure itself. The gap between what an institution preaches and what it practices is not hypocrisy. It is where every breach begins.
Eleven years later, the Pentagon is back at the Defense Manpower Data Center (DMDC).
DMDC is not some rando Pentagon office. The Pentagon stood it up in 1974 as the central hub for Department of Defense personnel data. Service status, benefits eligibility, who is who across the entire force. Anyone wanting a single place to understand the shape of American military personnel would start in this building. A repository like this is an attractive target for precisely this reason. OPM should have taught everyone to harden exactly this kind of target.
A vulnerability in a DMDC file-sharing system let unauthorized users reach files on the server. The files held names, Social Security numbers, dates of birth, contact information, race, gender, and military occupational specialties. Roughly 2.76 million living people were exposed, plus another 294,000 deceased, all current and former defense personnel and their dependents.
The unencrypted PII just sat there. The access ran from October 2025 to July 16, 2026, when DMDC finally found the flaw and patched it. For roughly nine months, unauthorized users could reach sensitive files on defense personnel before DMDC discovered the vulnerability. That is an insane undetected-access window for a federal government system.
Read that back and tell me what has changed since 2015.
The attacks themselves differ. OPM was a human adversary with stolen credentials living on the network. DMDC looks like a flaw in a file-sharing system. But the enabling conditions rhyme. A personnel-data hub. Sensitive data nobody protected well enough. A long quiet window of access. A custodian who discovered the problem rather than detected it. The word “discovered” carries a lot of weight in the disclosure, because discovery is what happens when detection fails.
OPM missed its intruder for roughly eleven months. DMDC missed its exposure for about nine. The dwell time barely moved in a decade. The exact vulnerability is not yet public, so whether encryption at rest would have helped remains an open question. The detection failure does not. It raises a much harder question. How does a defense personnel repository allow months of unauthorized file access without access telemetry or anomaly detection forcing the issue sooner?
Nobody can claim the lesson went unwritten. DoD wrote it down for itself. In 2022 it published a Zero Trust Strategy built around exactly this problem. Protect the data itself. Encrypt it at rest. Monitor file activity. Make access observable. The roadmap calls for file shares and databases to be watched for anomalous activity. Four years later, a defense personnel repository was serving unencrypted PII to unauthorized users for months. The failure here is not knowing what to do. It is actually doing it.
OPM became a strategic catastrophe for reasons DMDC, so far, does not share, and the differences matter as much as the echoes. OPM lost the SF-86, the 127-page questionnaire for national security positions. Foreign contacts, family members, financial history, psychological history, the whole intimate map a cleared person hands the government. I got one of those letters. So did almost everyone I know who ever held a clearance. The government mailed a polite notice explaining my most sensitive paperwork now sat in the hands of a foreign intelligence service, and offered credit monitoring for the trouble.
How honorable of them. A foreign spy service holds my fingerprints, my foreign contacts, and the 127 pages I wrote about at least ten years of my own life. The state’s grand remedy is to watch whether somebody opens a credit card in my name? Pffft, seriously? The threat was counter-intelligence. The fix was a free trial for a service never going to truly help.
In the OPM breach, threat actors took background investigation data on around 21.5 million people and 5.6 million sets of fingerprints. US officials privately tied the operation to Chinese state intelligence and described the broader collection effort as building enormous databases on Americans for counter-intelligence purposes. That is not mere identity theft. It is counter-intelligence, exactly what is expected of spies.
DMDC, as disclosed, is not that. The exposed set holds no clearance background data. No named adversary yet. The Pentagon says it sees no indication anyone misused the information, and it has not said whether anyone even copied the files. Anyone selling “OPM 2.0” right now skips past the simple fact nobody knows who did this or what they took, only what they could reach. Similar on the outside. Vastly different on the inside.
Do not let that distinction comfort you. Two things sit underneath it.
First, “no indication of misuse” does not mean “no misuse.” It means the absence of evidence from an organization blind to the hole for nine months. The same shop now assures you nothing came of it. Weigh that assurance against its own detection record.
Second, mass PII on three million defense personnel carries value with or without clearance files. Names tied to Social Security numbers tied to military specialties make a targeting list. It feeds phishing, impersonation, financial fraud, and the target profiling setting up operations everyone should truly care about. OPM already proved personnel data is a strategic asset, and the government filed it under administrative anyway. The data here ranks lower. The category of harm does not.
The real finding is not DMDC becoming the new OPM. It might land far short of it. The finding is darker. The specific failure OPM diagnosed in public, in a year-long congressional investigation, and in a dozen post-mortems stayed live inside a flagship defense data hub in 2026. Unencrypted PII. A soft file-sharing surface. Months of access. Detection never firing.
The lesson is not about China. It is about data warehouses, and the warehouses are still open. Eleven years after OPM, the threat actor can change and the exploit can change, but the underlying bargain remains exactly the same. Pile enough sensitive lives into one place, protect the pile badly enough, and eventually somebody is going to come shopping.