According to the notifications, hackers gained access to and exfiltrated data held within the DMDC's systems. Affected individuals are being contacted directly as the Department of Defense works through the scale of the exposure, which ranks among the larger data breaches to hit U.S. military personnel records in recent years.

Details on the specific data elements taken, the intrusion vector, and any attributed threat actor have not been fully disclosed in the available reporting. No CVE identifier or advisory ID has been published in connection with this incident.

Those potentially affected should:

• Watch for official notification from the DMDC or Department of Defense
• Treat unexpected communications referencing military service details as suspicious
• Monitor financial and credit accounts for signs of identity theft or fraud
• Consider placing a credit freeze or fraud alert if notified of exposure

Source: BleepingComputer

If you or your organization work with defense personnel data, how are you approaching notification and identity monitoring in the wake of this breach?