The recent breaches involving the Pentagon’s Defense Manpower Data Center and FBI personnel data should make us rethink how we manage identity. In the DMDC case, people had access for months to unencrypted records with Social Security numbers and other permanent details on millions of people, including information about military roles.
The usual questions come up right away: how did they get in, which controls failed, was the data encrypted, and what do we fix?
Those questions matter. But they only come after a bigger decision has already been made: the decision to collect, centralize, and keep large amounts of sensitive information in the first place.
For decades, identity has mostly been about possessing data. To prove who someone is, organizations gather attributes about them, check them, and often store the records for later.
That approach made sense when identity was mostly tied to physical documents and closed systems.
It is much harder to justify now, in a digital and Super Intelligence world, where the same information gets requested, copied, and stored over and over across government, banks, healthcare, employment, marketplaces, and almost every other sector.
The Pentagon incident stands out because the Defense Manpower Data Center sits at the center of identity-related data for the military. When the organization that holds some of the most sensitive identity information in the country gets compromised, the answer cannot just be that everyone else needs a stronger perimeter.
There is no such thing as a permanently impenetrable system.
And once identity information gets out, fixing the vulnerability does not make that information private again. A password can be changed. A credit card can be replaced. A Social Security number, date of birth, or other basic identity attribute generally cannot.
That matters because many systems still treat knowing those attributes as proof that someone is who they claim to be.
The problem is getting clearer: as more personal information becomes available through breaches, fraud, social engineering, and better digital attacks, knowing facts about someone is less and less useful as proof that the person presenting them is actually that individual.
Identity architecture has to account for that.
Organizations will always need to establish trust. A bank needs to know it is dealing with the right customer. A government agency needs to know if someone is entitled to a service. A business may need to confirm that someone holds a valid credential, meets a requirement, or has already been properly verified.
But confirming those things should not automatically mean every organization has to take possession of all the information used to prove it. There is a real difference between verifying a fact or a trust level and owning the underlying data. Modern identity infrastructure, built around reusable, privacy-preserving credentials that support selective disclosure, should be designed around that distinction.
One path forward is a Trust Credential for Life that carries a Trust Token Number (similar to a Know Traveler Number with TSA PreCheck). A neutral Trust Bureau could issue and maintain that credential so organizations can verify what they need without ever collecting or storing the underlying personal data themselves.
The cybersecurity conversation needs to move past just protecting databases. It should also ask how many copies of sensitive information need to exist, how long that information needs to be kept, and whether trust established in one place can be securely recognized somewhere else.
That becomes even more important as AI agents start acting on behalf of people and organizations. The question will no longer just be “Who is this person?” It will also be: who authorized this action, what authority does the agent have, and can that authority be independently verified without every relying party holding a full copy of the underlying identity data?
More data will not solve that problem. Better cybersecurity will still be essential, along with encryption, access controls, and operational discipline.
But the long-term answer cannot simply be collecting more identity information and getting better at guarding it. A more resilient model reduces the amount of sensitive information that needs guarding in the first place.
For years, identity has been treated mainly as a data-management problem. It is increasingly becoming a trust-management problem.
That is the larger lesson these breaches should force government and industry to confront.