More than 3 million current and former US military personnel, civilian workers, and others had personal information exposed in a months-long breach of the Defense Manpower Data Center, including Social Security numbers and military service records. About 2.8 million living people and 294,000 deceased individuals were affected, according to a Pentagon official.
Unauthorized users accessed the data between October 2025 and July 2026 after exploiting a vulnerability in an unspecified file-sharing system. A notification sent to an affected person said the vulnerability was discovered on July 16 and immediately patched.
Social Security Numbers and Military Records Exposed
Information involved in the breach included names, dates of birth, Social Security numbers, contact information, military occupations, and other personnel records. The exact information exposed differed between individuals, and the compromised records were not encrypted.
The Department of Defense said it has not found evidence that the stolen information has been misused. Officials have not publicly identified the people behind the intrusion or explained why the affected personal information was stored without encryption.
Affected individuals are being offered 12 months of credit monitoring through data breach recovery company IDX. The Pentagon has also said the DMDC began privacy and cybersecurity incident response procedures after discovering the breach.
DMDC Holds Records on Millions of People
The Defense Manpower Data Center is a Department of Defense records and identity management organization that maintains information covering more than 60 million service members, veterans, civilian employees, contractors, and military family members. Its systems are used to determine benefits and entitlements and support identity verification for military credentials.
DMDC also supports Common Access Cards, which are used by military personnel and other authorized users to enter facilities and access Defense Department computer networks. An earlier Pentagon review found documentation problems affecting about 215,000 active-duty and reserve personnel with those cards, although officials said there was no evidence that issue caused a data breach.
The incident follows other recent breaches involving federal employees, including a September cyber incident at the FBI. It also recalls the 2015 Office of Personnel Management breach, in which attackers obtained records belonging to more than 22 million current and former federal workers.
The Pentagon has not disclosed whether the DMDC attackers demanded money, communicated with US officials, or targeted a particular group within the database. It has also not publicly attributed the intrusion to a specific hacking group or foreign government.
Featured image credits: Magnific.com
For more stories like it, click the +Follow button at the top of this page to follow us.