Unencrypted Pentagon Records, an FBI Portal Breach and 16,000 Exposed Supabase Databases: The Case for Tokenising PII

Week of 5 October 2026 | Compiled by Team Paringa

This week's incidents share one root cause: sensitive personal data sitting in the clear, in systems that were never designed to make a breach survivable. Regulation is shifting too, with the EU AI Act's high-risk deadlines pushed back while transparency duties stay put.

What Happened This Week

🔴 Pentagon identity records stolen over nine months, stored unencrypted

On 30 September, TechCrunch reported that the US Department of Defense had notified individuals of a breach at the Defense Manpower Data Center (DMDC), the Pentagon's primary identity management provider. Attackers exploited a vulnerability in an unspecified file-sharing system and had access between October 2025 and mid-July 2026. Approximately 2.8 million living people were affected, plus close to 300,000 deceased individuals.

The stolen data included Social Security numbers, names, dates of birth, sex, race and military service details. Critically, the records were unencrypted. The Department said it had no evidence of misuse and the attackers remain unidentified. DMDC holds more than 60 million records, so the exposure of a few million is a fraction of what sits behind the same perimeter.

The same week, TechCrunch reported the FBI had declared a "cyber security incident" after its job application portal was compromised through an Oracle PeopleSoft HR server. Data reportedly included staff names, addresses, Social Security numbers and medical and psychiatric records, and the group ShinyHunters claimed responsibility. A third incident in the weekly roundups, Times Car in Japan, reportedly lost 6.6 million user accounts including driver's licence details. Three very different organisations, one pattern: long dwell times and plaintext sensitive fields.

Sources: TechCrunch | TechCrunch | Privacy Guides

Nine months of access means perimeter detection was never going to be the control that mattered. The control that matters is what the attacker walks away with. If national identifiers sit in the application database as tokens and the real values live in an isolated vault, a file-share compromise yields little of value. For any client holding SSNs, passport or licence data, the question for the board is simple: if someone was already inside for nine months, what would they have taken? Start with a field-level inventory of where identifiers are stored in the clear.

🟡 Around 16,000 Supabase databases exposing personal data

TechCrunch reported on 25 September that research from UpGuard found around 16,000 Supabase databases exposing personal data publicly, including names, addresses, phone numbers, passwords and authentication tokens. The cause is misconfiguration in applications built by developers, many using AI-assisted or hastily written code, rather than a flaw in the platform's secure defaults. Supabase's CISO said "Security at Supabase is never finished."

Under UK and EU GDPR the data controller carries the liability, not the platform vendor. A startup that ships an AI-generated app with an open table is the controller of that exposure, and so is the enterprise that commissioned it.

Sources: TechCrunch | Privacy Guides

Shadow development is now a privacy problem as much as a security one. Business units and vendors are spinning up AI-built apps that quietly collect customer data. The commercial play is a governed data layer that developers call instead of storing PII themselves, so a misconfigured table holds tokens, not people. Ask clients how many internal and third-party apps hold personal data they have never catalogued.

🟡 EU AI Act: high-risk deadlines move, transparency duties do not

Following the Digital Omnibus agreement, stand-alone high-risk AI obligations moved from 2 August 2026 to 2 December 2027, and high-risk systems embedded in regulated products to 2 August 2028. According to Jones Walker, Article 50 transparency duties (chatbot disclosure, synthetic content marking, deepfake labelling) remain on the original schedule. Penalties reach EUR 15 million or 3% of worldwide turnover.

Sources: Jones Walker | Gibson Dunn

The delay is a gift to teams that use it and a trap for those that treat it as a pause. GDPR applies to training and inference data today, regardless of AI Act timing. Use the extra months to establish what personal data flows into models and prompts, and keep it out by default.

What CTOs and data leaders Are Dealing With

Breach notifications are arriving long after the event, and the data lost is increasingly the most sensitive kind. At the same time, AI-assisted development is multiplying the number of places personal data can land, many outside central IT view. Data leaders are being asked to prove control over data they cannot yet map.

The practical shift is from protecting systems to protecting data itself. Tokenisation, field-level encryption and vault isolation reduce the blast radius when, not if, a system is breached, and they make regulatory conversations with the ICO or EU authorities considerably easier.

Three Things Worth Watching Next Week

1. Fallout from the DMDC and FBI breaches — watch for congressional questions on "major incident" notification and any further ShinyHunters disclosures.

2. Supabase-style exposure follow-ups — further research on AI-generated apps leaking data is likely, so expect regulator and customer questions.

3. Article 50 readiness — chatbot and synthetic content disclosure duties remain in scope, so clarify who owns them internally.

Could not verify: No fresh ICO enforcement action dated within the last 10 days was found, and no iapp.org or theregister.com pieces were fetched for this edition. The Times Car figure and the weekly roundup details come from secondary roundups (Privacy Guides, This Week in Security), not the original reports. Whether the Omnibus text has been published in the Official Journal was not confirmed from the page fetched (it described publication as expected in July 2026).

Questions? hello@paringa.ai

Paringa helps organisations make personal data safe to use, so AI and analytics programmes can move without adding breach risk. We pair practitioner advice with Skyflow's data privacy vault approach. | 5 October 2026 | © Paringa Ltd