Pentagon confirms data breach: over 3 million people affected
The unauthorized intrusion lasted for months.
Pentagon. Image by Joshua Roberts | Reuters
Follow us
- DMDC says a file-sharing system flaw exposed personal data for more than 3 million people.
- The exposed data included Social Security numbers, names, birth dates, contact details, and military personnel information.
- Unauthorized users accessed unencrypted files for months, starting in October 2025.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The Defense Manpower Data Center (DMDC), an agency within the US Department of War that maintains databases for manpower, personnel, training, and other areas, has suffered a significant cybersecurity breach.
DMDC discovered the breach on July 16th, 2026, according to the notification letters sent to affected individuals.
The incident exposed personal data of more than 3 million people, 2.8 million of whom are living individuals, and 294,000 are deceased former defense personnel or their dependents, according to the Pentagon’s numbers quoted by CNN.
“A security vulnerability in a DMDC file-sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file-sharing system to patch the vulnerability, and the system was restored,” reads the notification letter to one of the victims, shared on Reddit.
The intrusion lasted for months. “A small number of unauthorized users” had been accessing files with unencrypted personally identifiable information (PII) since October 2025.
The affected data includes Social Security numbers (SSNs) and one or more additional identifiers:
- name
- date of birth
- contact information
- sex
- race
- military personnel information (such as occupational specialty)
The agency oversees more than 60 million department personnel records, including those of military, civilian, contractor, family member, retiree, and veteran personnel, as of 2024, according to its website.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Following the privacy and cybersecurity incident response actions, DMDC also said it is taking appropriate actions to assess and enhance the cybersecurity posture of its system.
The Department of War has no indications that the accessed information was misused. The victims have been offered 12 months of free credit monitoring services.