Observed Signal · Sep 30, 2026 · Policy Update · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
Hackers steal millions of US military personnel records
The U.S. government is alerting millions of current and former military personnel that their personal information, including Social Security numbers and service records, was stolen in a months-long breach of the Pentagon's Defense Manpower Data Center (DMDC). The breach exploited a file-sharing vulnerability between October 2025 and mid-July 2026, affecting about 2.8 million living people and nearly 300,000 deceased. The data was unencrypted. The Department of Defense found no evidence of misuse yet. This follows a similar breach at the FBI attributed to ShinyHunters, raising concerns about national security risks.
This breach impacts a massive number of military personnel and highlights systemic security weaknesses in government data systems, potentially influencing data security policies and identity management standards relevant to AdTech's data protection landscape.
Track Real-Time Security Signals & Market Shifts
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- The DMDC breach exposed personal data of about 2.8 million living people and nearly 300,000 deceased.
- The attackers exploited a file-sharing vulnerability for months between October 2025 and mid-July 2026.
- The stolen data included Social Security numbers, names, dates of birth, and military service details, unencrypted.
- The Department of Defense reported no indication of data misuse.
- This breach follows a similar incident at the FBI attributed to ShinyHunters.
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
IDScan confirms data breach of 150 million driver's licenses
Identity verification service IDScan has confirmed a data breach involving the theft of over 150 million driver's license records from its cloud systems. The stolen data includes full names, driver's license numbers, and other government ID numbers such as passports. The breach, which occurred over a year-long hack, was first reported by cybersecurity journalist Brian Krebs. IDScan, based in Louisiana, serves corporate clients including entertainment venues and cannabis dispensaries. The company acknowledged the incident on September 1 after receiving information about a claim of a hack, and its investigation is ongoing. The FBI and Pentagon are reportedly investigating. The stolen database is accessible on the dark web, with searchable records including photos.
ShinyHunters leaks Florida driver data after ransom unpaid
The ShinyHunters hacking group has published hundreds of thousands of files from Florida's vehicle and driver database (DAVID), which was breached earlier in September. The group claims the leak occurred because the state agency, FLHSMV, did not pay a ransom or cooperate. The stolen data includes certificates of vehicle ownership, vehicle identification numbers, and some Social Security numbers and government-issued documents, but not driver's licenses. FLHSMV confirmed the breach, attributing it to compromised police officer credentials. The event follows a separate major breach at identity verification firm IDScan, which resulted in over 150 million driver's license images being stolen. This incident highlights ongoing vulnerabilities in government data systems and the increasing threat of cybercriminal groups targeting sensitive citizen data, with potential implications for identity fraud and advertising data security.
124M Passwords Stolen in Stealer-Logs
HaveIBeenPwned has added a dataset containing 124 million stolen passwords and 56 million email addresses to its breach directory. According to the service, the credentials were harvested from infected end-user machines and aggregated in so‑called stealer‑logs created by infostealer malware, rather than leaked from a single major online provider. HaveIBeenPwned did not disclose how it obtained the dataset or whether the records are already circulating on darknet markets. The site allows users to search both email addresses and passwords to check for exposure; registration unlocks additional history and alerting features. Security best practices remain the same: immediately change exposed passwords and avoid reusing them across services.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.