HOW DRU CATCH SEES IT

America's Most Secure Institution Left the Side Door Open

The Pentagon can track a ballistic missile across three time zones and redact a satellite photo down to the individual fence post. It runs nuclear submarines, stealth aircraft and classified war rooms sealed tighter than a Swiss bank vault. It cannot, apparently, be bothered to encrypt a spreadsheet of names and Social Security numbers belonging to the people it employs to defend the country.

That is not a bug. That is a philosophy. The Defense Manpower Data Center stored millions of unencrypted personnel files on a file-sharing system that unauthorized users could simply walk into - for roughly nine months. Not nine hours. Nine months. A human being can gestate a whole other human being in less time than it took anyone at the DMDC to notice the front door was wide open.

The OIG Already Sent the Memo. Nobody Read It.

The kicker that elevates this from embarrassing to genuinely infuriating: the Defense Department's own Inspector General had already told them the system was broken. In a report published days after the breach, the OIG confirmed that officials had failed 14 of 20 core federal cybersecurity benchmarks - the basic minimum requirements that exist precisely because data breaches happen. The Pentagon did not fail an advanced test. It failed a beginner's checklist.

The lawsuit lists the missing safeguards as 'standard cybersecurity controls': regular account reviews, vulnerability scanning, field encryption of Social Security numbers, routine log monitoring. These are not exotic countermeasures. These are the same tools any mid-sized hospital, accounting firm, or dental practice would implement on a Tuesday afternoon. The institution with the largest defense budget on earth apparently skipped that Tuesday.

Twelve Months of Credit Monitoring: The Pentagon's Idea of Making It Right

When the breach was finally discovered, the Pentagon's response was to offer 12 months of credit monitoring - the digital equivalent of handing someone a band-aid after a nine-month flood. Some service members did not even receive that offer until two or three months after the breach was known internally. The people whose job is to defend the nation had to wait in line to find out their identities may have already been stolen.

Two Marines - veteran Tristyn Edwards and active-duty Marine Morgan Stampfli - have since filed a federal class-action lawsuit, alleging fraudulent charges and a surge of spam as direct consequences. Their complaint argues the Pentagon violated federal privacy laws despite internal warnings. The gap between the Pentagon's self-image as the ultimate security institution and its demonstrated inability to follow a federal cybersecurity checklist is not just ironic. It is a documented institutional failure, written up by its own watchdog, and addressed with twelve months of Equifax alerts.