United States Department of Defense

Unauthorized users reached the Defense Manpower Data Center's personnel database in October, and the Pentagon did not notice until July, nine months later. The records sat unencrypted, so the breach was never a matter of cracking anything; it was a matter of opening a file cabinet nobody had bothered to lock. The notice cites no financial loss, but Social Security numbers belonging to up to four million service members, per Military Times, cannot be reissued like a card number. Nobody has named the entry point or the perpetrator, which says less about the attacker than about what the Pentagon was watching.