Pentagon Personnel Agency Data Breach Impacts 3 Million People
Pentagon's Defense Manpower Data Center breach exposed SSNs and PII of 3 million people after nine months of unauthorized file access.
The Defense Manpower Data Center is notifying individuals that unauthorized users accessed files on a file-sharing server containing unencrypted PII from October 2025 until discovery on July 16, 2026. A Department of War official said the breach impacts 2.76 million living and 294,000 deceased individuals. Exposed data included Social Security numbers, names, dates of birth, contact details, and military occupational specialties. There are no indications of misuse, and no group has claimed credit.
- 3 million people affected: 2.76 million living, 294,000 deceased
- Unencrypted PII included Social Security numbers and military occupational specialties
- Unauthorized access persisted roughly nine months before July 16, 2026 discovery
- Vulnerability patched at discovery; no misuse indicators reported
Full article318 words · extracted from securityweek.com · click to collapse
The US Defense Manpower Data Center (DMDC), which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed.
According to the DMDC’s notice, unauthorized users had access to one of its file-sharing servers for roughly nine months.
A copy of the notification letter, dated September 18 and shared online by a recipient, says the problem was discovered in mid-July.
“On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored,” the letter reads.
The letter does not name the affected file-sharing product or describe the vulnerability.
“Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII,” the letter says.
Advertisement. Scroll to continue reading.
Exposed records varied by individual and included Social Security numbers alongside names, dates of birth, contact details, demographic data, and military occupational specialties.
“At this time, DoW does not have any indications of misuse of the accessed information,” DMDC says.
The letter does not say how many people are affected. A Department of War official told CNN that the breach impacts 2.76 million living individuals and 294,000 deceased individuals.
According to its website, DMDC held at least 60 million records as of fiscal year 2024. Those records cover military and civilian personnel, contractors, family members, retirees and veterans.
It is unclear who is behind the cyberattack. No known cybercrime group appears to have taken credit for an attack on the DMDC.
DMDC says it launched privacy and cybersecurity incident response actions after finding the vulnerability.
Related: DC Health Agency Exposes 400,000 Beneficiary Records
Related: Astrana Health Data Breach Impacts Private, Confidential Information
Related: ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report