COLUMN: Trump rejects Iran’s plan and renames Hormuz; the Pentagon took nine months to see its breach

Four words on the South Lawn

Saturday, before Tennessee

“I reject their proposal.”

Four words. Donald Trump spoke them on September 26, 2026, as he left the White House by the South Lawn, before flying off to a campaign stop in Tennessee, Al Jazeera reports.

The proposal is Tehran’s. Seven days to reopen the Strait of Hormuz, provided Washington pays first.

Four words, and a calendar that opens. Not the calendar of peace. The one that starts after November.

The refusal is public. What comes next is confided to aides, then read in a newspaper.

A letter dated September 18

Elsewhere, another sheet of paper went out to service members’ mailboxes. A letter from the Defense Manpower Data Center, dated September 18, according to Military Times. It says Social Security numbers were read by unknown parties.

You read it at the kitchen table. You read it again. You look for the sentence that says everything is fine. All it says is that you are being offered a year of credit monitoring.

Two pieces of paper, eight days apart. A president turning down a truce. A department admitting a breach. Neither one mentions the other.

Four words for the truce. One letter for the breach.

Seven days, says Araghchi

Through Qatar, on Friday

The plan arrived on September 25. Iran’s foreign minister, Abbas Araghchi, passed it along through Qatar, Al Jazeera reports.

His conditions fit in four lines. Lifting the US naval blockade of Iranian ports. Suspending sanctions on Iranian oil sales. Releasing about $12 billion in frozen assets. A regional ceasefire that includes Lebanon and Yemen.

In exchange, Araghchi said, “if the necessary conditions are met,” the strait can reopen within seven days.

Day 6, day 7

Euronews lays out the timetable. Four to five days of initial steps. The strait reopens on day 6. Nuclear talks begin on day 7.

The plan is a shorter version of a memorandum of understanding signed in June, which allowed 60 days. That memorandum collapsed, France 24 recalls.

And yet, seen from Tehran, the plan already comes packaged as a concession on timing: from sixty days down to seven.

Seven days. That is the unit of the Iranian plan. Remember it. Two more units are coming.

Seven days to reopen, but the money first.

A strait with a new name

A map on Truth Social

The same day, on his Truth Social network, Donald Trump posted a map. The Strait of Hormuz is circled. Beneath it, a new name: “Trump Strait,” Euronews and France 24 report.

A strait fought over since late February. A family name stamped on top.

It is not a decision. It is a signal. To Tehran, it says: I hold this passage. To Washington, it says: look at the map, not at the rest.

A name, not a door

A name. Not a plan. Because the rest exists. And it is not on the map.

This column stands with American service members, those whose identities leaked and those who could be sent back to strike Iran. It stands against an administration that dates its next campaign by the electoral calendar without closing the breach that exposes them. Because an intruder read their files from October 2025 until July 16, 2026, and nobody saw it for nine months.

You can rename a strait. Not a number.

A name on the map. A breach off the map.

After November

What officials told the Journal

The Wall Street Journal reports, citing US officials, that Trump rejected the Iranian proposal. He is said to doubt that Tehran can meet his demands.

Above all, he reportedly told aides that he expected to resume bombing Iran after the November midterm elections, according to Euronews, citing the Journal.

This is reported information. It is not a decree. But it says something the four words on the South Lawn did not: a date.

The same Saturday, Tennessee

On the same Saturday, the president turned down the truce, then left to campaign.

Here is the second unit of this piece. After seven days, the weeks left before the vote.

A war that waits for the ballot box is not a war that waits for the enemy.

An electoral calendar is set in Congress and at the polls. A military calendar should be set by the threat, by the ground, by the state of the forces.

And yet, between the two, the same service members are the ones left waiting.

I don’t know what the president thinks. I know what is attributed to him, and the date attributed to him.

The truce is refused. The next round waits for the vote.

October 2025, an open door

A file-sharing system

Back to the letter.

The Defense Manpower Data Center, or DMDC, manages personnel records for the Department of Defense. About 60 million records, according to CNN.

Unauthorized users gained access to a vulnerable server at the center starting in October 2025, Military Times and CNN report. The flaw sat in a file-sharing system.

October. November. December. January. February, when Hormuz became the heart of the crisis. March. April. May. June.

During those months, service members were transferred, promoted, sent to the Middle East. Their files followed them. Someone had access.

July 16

The vulnerability was identified on July 16, 2026, according to Military Times. Nine months after the first intrusion.

Nine months. Three seasons. A crisis that broke open in between.

Then it took another two months for the letter to go out, dated September 18.

Nine months to see it. Two months to write. One year of protection.

The third unit of this piece is right there. Not seven days. Not a few weeks. Nine months.

Nine months without seeing. Two months to write.

Four million, per two sources

Unencrypted numbers

How many people? The department gives no figure. Two sources close to the matter gave one to Military Times: about 4 million Defense personnel.

That is an estimate. I treat it as one. Maybe fewer. Maybe more.

What was read, on the other hand, is spelled out in the letter. Social Security numbers, stored without encryption. And at least one other identifier: a name, a date of birth, contact details, sex, race or military specialty.

One year of monitoring

In response, the department is offering 1 year of credit monitoring and identity restoration services through the company IDX, according to Military Times.

One year of monitoring for a number that lasts a lifetime.

The Pentagon did not immediately answer questions about the scale of the breach or the identity of the intruders, the paper notes.

One year of protection for a nine-month breach.

Tehran’s plan came with a bill up front

Twelve billion before the strait

Now the South Lawn deserves some fairness. That costs this column something.

Rejecting this plan was not absurd. Tehran was asking for the blockade to be lifted, the sanctions on its oil to end and $12 billion in assets, all before reopening the strait on day six.

Money first. The strait next. The nuclear file last.

A toll, paid in unfrozen dollars, lifted sanctions, a loosened blockade. Everything up front. Nothing guaranteed after.

A regime that keeps a sea lane shut and gets paid to reopen it is not offering peace. It is selling a right of passage.

The June memorandum

And the precedent does not argue for trust. The June memorandum, which allowed sixty days, collapsed, France 24 recalls.

Iran’s president, Masoud Pezeshkian, said as much to Al Jazeera on Saturday: “We have no trust in the American side.” He added that he did not know on what basis an understanding could be reached. He denies that Iran is responsible for closing the strait.

It is true, this refusal can be defended. And it does not change this: turning down a truce means preparing what comes next, and what comes next means service members whose files leaked.

Refusing can be defended. What follows has to be prepared.

CENTCOM had warned

Threats already on record

The DMDC breach and the war on Iran are not two separate stories. CNN connects them. The risk is not theoretical. It is documented.

According to the network, US military leaders have already warned troops that they risk being targeted during the war with Iran.

Central Command, CENTCOM, had previously flagged “multiple threat reports” about adversaries exploiting commercial location data to go after personnel in the Middle East, CNN reports.

Profiling, phishing, approaches

Justin Sherman, who heads Global Cyber Strategies, tells CNN what a foreign adversary could do with a trove like this: phishing, profiling, approaches by foreign intelligence, and worse.

A Social Security number can be cross-referenced with other files. A military specialty says who does what. An address says where the family sleeps.

A Social Security number does not say where a soldier is. But cross-referenced with a specialty, a date of birth, an address, it says whom to write to, whom to approach, whom to follow.

And yet the Pentagon has identified no one. Nothing in the pages read ties the intrusion to Tehran. I won’t write that it does.

But you don’t prepare a campaign against a state with intelligence services while leaving that flank open.

The adversary doesn’t need to steal it. It only has to be out there.

No sign of misuse

The Pentagon’s line

Here is what the department would answer, and it deserves to be heard in full.

The Pentagon says it has “no indication” that the data were misused, CNN and Military Times report. The flaw has been fixed since July. Protection services are on offer. And a resumption of strikes, if it comes, does not hinge on a human resources server.

That is serious. And it does not hold. No indication. No one looking.

Nine months of not seeing

No indication, says the department. The same department had no indication of the intrusion itself for nine months.

Seeing no misuse, when you never saw the way in, does not prove there was no misuse. It proves no one was looking.

A door left open for nine months without an alarm does not necessarily leave a complete trail behind it. Otherwise, someone would have seen it sooner.

And CENTCOM, for its part, had seen threats aimed at its troops’ location data.

No indication, says the one who saw nothing for nine months.

The FBI too

A jobs portal

The same week, the FBI had its own admission to make.

On September 23, the bureau told NBC News it was aware that a criminal group claimed to have compromised its recruiting portal, FBIJobs.gov, with an alleged impact on its employees’ personal information. It is trying to establish whether the breach came through a third party or through its own systems.

The group calls itself ShinyHunters. It claims to have stolen 2 to 3 terabytes of files.

According to Nextgov, it says it holds the records of nearly 5,000 employees: names, home addresses, phone numbers, information on spouses and siblings. Intelligence analysts, lawyers, interns, special agents.

It claims it got in through a previously unknown vulnerability in Oracle’s PeopleSoft software, the trade outlet adds.

An authenticated sample

NBC News could not verify the full extent of these claims. But a former FBI agent confirmed to the network that a sample document containing sensitive personal data was authentic.

No ransom. ShinyHunters says it is acting in retaliation for a public FBI advisory issued on May 15, and demands that it be withdrawn, according to NBC.

The demand targets Director Kash Patel and the head of the cyber division, Brett Leatherman, with a one-week deadline, according to Nextgov. An expert quoted by the outlet, Dan Calderone, warns that the addresses of agents and their spouses could be published within the week if the threat is carried out.

A criminal group forcing a federal police force to talk about it. The portal, meanwhile, was unreachable when NBC published.

The Pentagon has its letter. The FBI, its silent portal.

The number you cannot change

You can change a password

Now put yourself in the place of the person who got the letter.

You change a password in a minute. You change a card PIN in a day. You change a phone number in a week. You change a lease in a month. You change a name, sometimes, in a year.

You don’t change a Social Security number.

It follows you for life. It is in the hospital file, in the children’s school file, in the mortgage file.

More than a number

And next to the number, sometimes, the military specialty. What you know how to do. And so where you are likely to be sent.

The spouse reading the letter over a shoulder is not thinking about credit. She is thinking about the map of the Gulf that has hung in everyone’s head since February. She is thinking about November.

The phone buzzes. Unknown number. You don’t pick up. You will never pick up quite the same way again.

Four million times, according to two sources.

A number for life. A letter for one year.

Seven days against nine months

Tehran’s calendar

The three units of this piece can now sit side by side.

Seven days is the calendar Tehran is offering, with payment up front.

A few weeks is what separates Saturday’s refusal from the November elections, after which the president reportedly expects to resume bombing, according to the Journal.

The Pentagon’s calendar

Nine months is how long it took the Pentagon to see that someone was reading its service members’ files.

Seven days, you negotiate. A few weeks, you wait out. Nine months, you let slip by.

And yet, of those three stretches of time, the longest gets the least attention.

The map changed its name on a Saturday. The DMDC door stayed open for three seasons.

Seven days on offer. Nine months ignored.

Close the breach before November

A hearing, a date

I’ll admit it: before this week, I couldn’t have told you what the DMDC is. Many military families couldn’t either. That is exactly why they needed to be warned fast.

The verdict comes in two parts, and I keep both. Two acts. Two verdicts.

Rejecting a plan that has to be paid for up front is a good move against a regime that keeps a sea lane shut. Announcing the sequel for after an election, renaming the strait, and leaving soldiers’ files within reach of strangers for nine months is a bad move against the people who will carry that sequel.

Congress can call a hearing on the DMDC. It can ask who at the department signed the September 18 letter, and why two months after the discovery. It can ask for an end date for the protection on offer.

The next Saturday

Before sending these service members back to strike Iran after November, who will answer to them for the nine months their files lay open?

The letter is on the kitchen table. The strait has a new name on a map.

A strait renamed in one Saturday. A breach nine months unseen.

Sources:

Primary Sources:

• Al Jazeera — Trump rejects the seven-day plan, interview with Masoud Pezeshkian, September 26, 2026
• Military Times — the DMDC letter and exposed personnel data, September 24, 2026
• NBC News — the FBI statement on the ShinyHunters claim, September 23, 2026

Secondary Sources:

• Euronews — the Wall Street Journal report and the “Trump Strait” map, September 26, 2026
• CNN via KRDO — the Pentagon breach and counterintelligence risks, September 25, 2026
• Really American — Trump rejects peace while his agencies are hacked, September 26, 2026