Massive data breach hits US military, exposing millions of records
What's the story
The US government is warning millions of current and former military personnel that their personal information was compromised in a recent data breach. The breach, which lasted several months, involved the unauthorized access of Pentagon's personnel records. A notification from the Defense Manpower Data Center (DMDC) said that unknown individuals exploited a vulnerability in an undisclosed file-sharing platform between October 2025 and mid-July 2026.
Data exposure
Breach affects living and deceased individuals
The security breach has exposed a wide range of personally identifiable information (PII).
This includes Social Security numbers, names, dates of birth, sex, race, and details about their military service.
The DMDC notification confirmed that the personnel records were not encrypted at the time of the attack.
According to CNN and Federal News Network, a Pentagon official said nearly 2.8 million living people and some 300,000 deceased individuals have been affected by this incident.
Record-keeping unit
What is the Defense Manpower Data Center?
The DMDC, though not widely known, is one of the Department of Defense (DoD)'s record-keeping units.
It maintains over 60 million records for US military and civilian employees and their dependents to determine benefits like healthcare and retirement.
The unit also serves as the military's "leading identity management provider," linking active-duty service members, employees, and contractors to credentials needed to access Pentagon computer systems or buildings.
Investigation ongoing
No evidence of information misuse
The Department of Defense, which oversees the DMDC, said it has no evidence that the information was misused but didn't explain how it reached that conclusion.
This incident is just one in a string of recent breaches involving federal workers' personal information, including a September breach at the FBI attributed to ShinyHunters hacking group.
Support offered
DoD offers free credit monitoring, identity-restoration services
In response to the breach, the Department of Defense is offering affected individuals one year of free credit monitoring and identity-restoration services through IDX, a private contractor.
Notifications began with breach letters dated September 18. The recipients have been advised to enroll in the service, monitor their credit reports, and watch financial/government-benefit accounts for unfamiliar activity.
This incident highlights broader concerns about how effectively the Pentagon safeguards large amounts of personnel information from potential breaches.