Eleven Years After the OPM Breach the Pentagon Lost Three Million More Records

the old school opm hack from back in the day should have taught us one thing. not that china is good at hacking. everyone already knows this. opm matters because it shows exactly how the federal government loses its people's data, and the way that happens is humiliating for everyone involved.

a records warehouse stuffed with unencrypted personally identifiable information. access controls soft enough that someone walked in with stolen credentials and stayed the better part of a year. nobody watched the inside closely enough to notice.

the hack looked sophisticated at the edges yet ran rather lazy at the core, because it never really needed to be anything more. it was easy to pull off. the government lecturing every state and local government, bank, contractor, and hospital on cyber security could not adequately secure itself. the gap between what an institution preaches and what it practices is not hypocrisy. it is where every breach begins.

eleven years later, we are back at the defense manpower data center (dmdc).

dmdc is not some rando pentagon office. the pentagon stood it up in 1974 as the central hub for department of defense personnel data. service status, benefits eligibility, who is who across the entire force. if you want a single place to understand the shape of american military personnel, this is the building. which is exactly why a repository like this is such an attractive target. opm should have taught everyone to harden exactly this kind of target.

so what happened? a vulnerability in a dmdc file-sharing system let unauthorized users reach files on the server. the files held names, social security numbers, dates of birth, contact information, race, gender, and military occupational specialties. roughly 2.76 million living people, plus another 294,000 deceased. current and former defense personnel and their dependents.

the unencrypted pii just sat there. the access ran from october 2025 to july 16, 2026, when dmdc finally found the flaw and patched it. roughly nine months in which unauthorized users could reach sensitive files on defense personnel before dmdc discovered the vulnerability. that is an insane undetected-access window for a federal government system.

read that back and tell me what has changed since 2015.

the attacks themselves differ. opm was a human adversary with stolen credentials living on the network. dmdc looks like a flaw in a file-sharing system. but the enabling conditions rhyme. a personnel-data hub. sensitive data nobody protected well enough. a long quiet window of access. a custodian who discovered the problem rather than detected it. the word "discovered" carries a lot of weight in the disclosure, because discovery is what you get when detection fails.

opm missed its intruder for roughly eleven months. dmdc missed its exposure for about nine. the dwell time barely moved in a decade. we do not yet know the exact vulnerability, so whether encryption at rest would have helped is an open question. the detection failure is not. that begs a much harder question. how does a defense personnel repository allow months of unauthorized file access without access telemetry or anomaly detection forcing the issue sooner?

and it is not as if nobody wrote the lesson down. the dod wrote it down for itself. in 2022 it published a zero trust strategy built around exactly this problem. protect the data itself. encrypt it at rest. monitor file activity. make access observable. the roadmap calls for file shares and databases to be watched for anomalous activity. four years later, a defense personnel repository was serving unencrypted pii to unauthorized users for months. the failure here is not knowing what to do. it is actually doing it.

here is where these two eerily similar sounding stories begin to diverge. the differences are just as important as the echoes.

opm became a strategic catastrophe for reasons dmdc, so far, does not share. opm lost the sf-86. the 127-page questionnaire for national security positions. foreign contacts, family members, financial history, psychological history, the whole intimate map a cleared person hands the government. i got one of those letters. so did almost everyone i know who ever held a clearance. the government mailed us a polite notice explaining our most sensitive paperwork now sat in the hands of a foreign intelligence service, and offered us credit monitoring for the trouble.

how honorable of them. a foreign spy service holds my fingerprints, my foreign contacts, and the 127 pages i wrote about at least ten years of my own life. the state's grand remedy is to watch whether somebody opens a credit card in my name? pffft, seriously? the threat was counter-intelligence. the fix was a free trial for a service that was never going to truly help.

in the opm breach, threat actors took around 21.5 million of those background-investigation records and 5.6 million sets of fingerprints. u.s. officials privately tied the operation to chinese state intelligence and described the broader collection effort as building enormous databases on americans for counter-intelligence purposes. that is not mere identity theft. that is counter-intelligence. it is what is expected of spies.

dmdc, as disclosed, is not that. the exposed set holds no clearance background data. no named adversary yet. the pentagon says it sees no indication anyone misused the information, and it has not said whether anyone even copied the files. anyone selling you "opm 2.0" right now skips past the simple fact we do not know who did this or what they took, only what they could reach. similar on the outside. vastly different on the inside.

do not let that distinction comfort you. two things sit underneath it.

first, "no indication of misuse" does not mean "no misuse." it means the absence of evidence from an organization that missed the hole for nine months. the same shop that missed the exposure now assures you nothing came of it. weigh that assurance against its own detection record. i think we are all on the same page here.

second, mass pii on three million defense personnel carries value with or without clearance files. names tied to social security numbers tied to military specialties make a targeting list. it feeds phishing, impersonation, financial fraud, and the target profiling that sets up operations everyone should truly care about. opm already proved personnel data is a strategic asset, and we filed it under administrative anyway. the data here ranks lower. the category of harm does not.

so the real finding is not that dmdc is the new opm. it might land far short of it. the finding is that the specific failure opm diagnosed in public, in congressional hearings, in a dozen post-mortems, stayed live inside a flagship defense data hub in 2026. unencrypted pii. a soft file-sharing surface. months of access. detection that never fired.

the lesson is not about china. it is about data warehouses, and the warehouses are still open. eleven years after opm, the attacker can change and the exploit can change, but the underlying bargain remains exactly the same. pile enough sensitive lives into one place, protect the pile badly enough, and eventually somebody is going to come shopping.