Pentagon personnel data center confirms breach affecting 3 million people

The Defense Manpower Data Center, a Department of War agency that maintains Pentagon personnel records, has notified more than 3 million people that their personal information was exposed after unauthorized users accessed a file-sharing system for roughly nine months.

DMDC discovered the security vulnerability on July 16, 2026, and said it immediately patched the flaw and restored the system. A subsequent investigation found that a small number of unauthorized users had been accessing files containing unencrypted personally identifiable information since around October 2025. The breach affected 2.76 million living individuals and about 294,000 deceased former defense personnel or their dependents, according to a Department of War official.

The exposed information varied by individual but included Social Security numbers along with at least one additional identifier, such as name, date of birth, contact information, sex, race or military personnel information like occupational specialty. DMDC maintains more than 60 million personnel records covering active-duty and reserve service members, civilian employees, contractors, retirees, veterans and family members, though officials have not said all of those records were affected.

The agency said it launched its privacy and cybersecurity incident response process after discovering the vulnerability and is assessing and strengthening the system’s security. Officials said there is currently no evidence the exposed information has been misused, and no cybercrime group has claimed responsibility for the intrusion.

Affected individuals are being offered 12 months of free credit monitoring and identity-restoration services through IDX, a contractor working with the Department of War. Notifications began reaching people through a breach letter dated Sept. 18, and enrollment is available through a dedicated IDX website using a code included in the notification, with a deadline of Aug. 19, 2027. DMDC recommended that affected individuals enroll promptly, review their credit reports, monitor financial and government-benefit accounts for unfamiliar activity, and treat unexpected calls, messages or emails referencing military employment with caution.