File Sharing Flaw Exposes Unencrypted Records of Over 3 Million People from Pentagon Defense Manpower Data Center
A flaw in a file sharing system permitted unauthorized users to reach files stored on a server operated by the Defense Manpower Data Center (DMDC), the central personnel registry of the U.S. Department of Defense.
The incident exposed records belonging to more than 3 million people. The DMDC maintains over 60 million records covering active-duty and reserve military personnel, civilian employees, contractors, retirees, veterans, family members, and other individuals affiliated with the department.
All exposed information was stored without encryption. The dataset included full names, Social Security numbers, dates of birth, contact information, gender, race, and functional details such as each person’s military occupational specialty.
Unauthorized access occurred between October 2025 and July 2026, a period of approximately nine months before the organization detected the problem. The DMDC identified the flaw on 16 July 2026, applied an immediate remediation, restored the system, and activated its privacy and cybersecurity incident response procedures.
Victim notification letters dated 18 September were mailed two months after discovery. Every affected individual is being provided one year of free credit monitoring and identity restoration services through the contractor IDX, which works with the Department of Defense.
No public attribution has been made regarding the responsible parties or the motive behind the access. According to published materials, investigators have found no evidence that the exposed information was misused.
Related articles
Beget Loses Accreditation as .RU and .РФ Domain Registrar After Cyberattack
Following a cyberattack on November 2, Russian domain registrar and hosting provider Beget has had its accreditation temporarily suspended by the Coordination Center for .RU and .РФ domains. The company can no longer register new domains in the .RU, .РФ, and .SU zones or accept transfers from other registrars. Beget must continue supporting all domains registered before the suspension, and expiration dates have been postponed by agreement with the Coordination Center and RosNIIROS to prevent any loss of domains. The incident stems from attackers gaining access to the management infrastructure and deploying wiping scripts. Partial functionality has been restored in the control panel, but full domain management features for the affected zones will return only after accreditation is reinstated. No specific recovery timeline has been announced.
Beget Rebuilds Cloud Infrastructure After Destructive Cyberattack Wipes VPS Backups
Beget suffered a severe cyberattack that allowed threat actors to access the management layer of its entire cloud architecture and execute wiping scripts. The incident destroyed cloud infrastructure and left backup copies of VPS files available to only half of the affected users. Internal systems were also hit, breaking links between customer accounts and services, forcing the provider to reconstruct ownership records. Hosting services have recovered more than 60 percent, while full cloud restoration timelines remain unknown. The attack disrupted BelkaCar’s car-sharing application, which relied on Beget for backend connectivity and has since migrated to another provider.
Fukuoka Prefecture Exposes Personal Data of 183 Corporate Officers Due to Website File Misconfiguration
Fukuoka Prefecture has confirmed that personal information belonging to 183 corporate officers from 24 organizations was left publicly accessible on its official website. The exposure occurred within files related to the Fukuoka Prefecture Easy-to-Work Care Workplace Certification System. The files were uploaded by a contracted vendor between August 21 and September 17, 2026, with incorrect permissions that allowed online editing and saving instead of read-only access. The issue remained undetected until an applicant inquired about download procedures. Upon discovery, the prefecture instructed the vendor to remove the files and contacted all 24 affected corporations by telephone to provide explanations and apologies. The incident highlights risks associated with improper configuration of application files containing sensitive personal data on government websites.
New Container, Old Code: Web Shell Persists Three Months in 1C-Bitrix Environment
Two 1C-Bitrix sites shared a web shell named WebShellOrb after an attacker exploited multiple vulnerabilities in a custom appeal application. The initial compromise went undetected because Nginx logs were retained for only one month, leading responders to conclude that no scanning activity remained visible. After agents showed no malicious code, administrators restarted the container without addressing the underlying issues in the shared filesystem and source code. The attacker regained access weeks later by reusing JWT tokens generated with a hardcoded secret and by exploiting SQL injection flaws that allowed password hash extraction. Shared system user accounts and a common filesystem volume enabled the shell to propagate between sites and survive container recreation. The incident highlighted that redeploying containers and rotating passwords failed to eliminate persistence rooted in unpatched code and misconfigured authentication logic.