Nine Months of Undetected File Access
In October 2026, the Defense Manpower Data Center disclosed that unauthorized access to personnel files had continued for nine months — from October 2025 to July 2026 — before detection. Roughly 3 million records were potentially exposed, containing unencrypted Social Security numbers, birth dates, contact information, and military occupational specialties.
The breach involved a file-sharing system. Someone accessed files. Read them. Extracted data. For nine months, nobody noticed.
This wasn’t a zero-day exploit or a sophisticated nation-state technique. It was unauthorized file access on a Windows system that went undetected because the tools in place couldn’t see it happening in real time.
FISMA continuous monitoring requirements exist precisely to prevent this scenario. Real-time detection of unauthorized access to sensitive data. Not snapshots. Not quarterly audits. Immediate visibility into who is reading what files, when, and with which program.
Native Windows auditing creates logs, but those logs are reactive. They record what happened. They don’t stop it. And in high-activity environments, Event Viewer logs roll over, burying evidence before anyone looks. The knowledge base is direct about this: “In most cases, organizations never know this has occurred because they only do occasional point-in-time security checks, or snapshots, and they have no idea what has happened between the snapshots.”
Blocking Unauthorized File Reads at the Kernel Level
FileSure Defend operates at the Windows kernel — intercepting file operations before they complete. It controls which programs can perform which file operations. Not just which users. Which programs.
A valid user credential doesn’t mean every program that user runs should be able to read personnel files. If the authorized application for accessing DMDC records is a specific personnel management system, then only that program should be able to open those files. A browser, a script, an unauthorized utility — blocked at the file system layer, even if the user is authenticated.
Here’s what a FileSure policy for personnel records would look like:
File Name Filter: *personnel*.db, *SSN*.csv, *PII*.*
Allowed Programs: C:\Program Files\DMDC\PersonnelApp.exe
Blocked Operations: Read, Write, Delete (for all other programs)
Drive Type: Network Share, Local
Audit Mode: Log all access attempts, allowed and blocked
Every file read is logged in real time. Not in Event Viewer where it rolls over. In a centralized audit trail that correlates access patterns and flags anomalies immediately.
If an unauthorized program attempts to read personnel files — blocked. If an authorized program exhibits unusual behavior (bulk reads at 2 AM, access from an unexpected machine) — flagged immediately, not discovered nine months later.
The breach would have been stopped at the first unauthorized file access, or detected within seconds if the accessing program was legitimate but the access pattern was anomalous.
Legacy Systems and Government Compliance
Government agencies run on infrastructure that works — and can’t easily be replaced. Custom applications, specialized databases, Windows versions that can’t be upgraded without breaking mission-critical systems.
FileSure runs on every Windows version from legacy systems through Windows 11 and Server 2022. It doesn’t require replacing anything. It protects the systems agencies have, with the operating systems they’re running, right now.
FISMA compliance requires continuous monitoring. FileSure provides it — real-time logging of all file access, change detection, and anomaly identification across the entire Windows infrastructure.
The Pentagon breach is a reminder that the most sensitive data in government systems isn’t always protected by the most modern tools. It’s often sitting on file shares, accessed by programs that may or may not be authorized, with audit trails that only get reviewed after something goes wrong.
Kernel-level file access control stops the problem before the file is read. Not after. Not nine months later.
Start a free trial at bystorm.com and see how FileSure protects the systems you can’t replace.
Source: Pentagon, FBI personnel-data breaches raise questions – Defense One
Category: Data Loss Prevention
Tags: dmdc breach, personnel data, file access control, fisma compliance, kernel filter driver, government cybersecurity, unauthorized file access, real-time monitoring
