Pentagon DMDC data breach exposes 3 million records

A months-long data breach at the Pentagon’s Defense Manpower Data Center has exposed sensitive personal information for more than three million people connected to the U.S. military, including unencrypted Social Security numbers and employment details.^{[1][2][3][4][9][10][15]} Defense officials say the incident affected roughly 2.76 million living individuals and about 294,000 deceased people whose records were stored in the DMDC system.^{[1][2][4][5][9][10]} So far, the Pentagon reports no evidence that the compromised data has been misused, but has begun notifying affected individuals and offering identity protection services.^{[1][2][5][10]}

The Defense Manpower Data Center serves as a core human-resources and personnel records hub for the Department of Defense, maintaining data on service members, civilian employees, contractors, and some dependents.^{[2][3][14][15]} According to multiple media reports citing Pentagon officials, the exposed records include names, Social Security numbers, and job or occupational specialty information tied to military and civilian roles, with some sources also referencing service history details.^{[1][4][5][9][10][15]} Several outlets note that the data was stored in an unencrypted form, magnifying the potential harm if the information is ever abused.^{[4][9][11][13]}

Unauthorized users are believed to have accessed a DMDC information system from October 2025 until mid-July 2026, giving them a window of roughly nine months in which sensitive personnel data was exposed.^{[1][3][4][7][9][10][13][15]} The breach has been traced to a vulnerability in a DMDC file-sharing system that allowed a small number of external users to reach files on a server containing personally identifiable information.^{[2][3][7][8][9][13][15]} Officials say the issue was discovered around July 16, at which point DMDC updated and patched the file-sharing platform, restored the affected system, and initiated privacy and cybersecurity incident response procedures.^{[2][3][8][9][15]}

Public reporting to date has not identified a specific commercial product, software component, or CVE associated with the exploited vulnerability, suggesting the flaw may have arisen from configuration or custom system issues rather than a widely known bug with an established CVSS score.^{[2][3][7][8][9][13][15]} In the absence of a disclosed CVE or vendor advisory, defenders outside the Pentagon must rely on high-level descriptions of the incident and general hardening guidance for file-sharing systems and internal data repositories, rather than deploying a targeted patch for a known product.^[2][8][13]

The exposure of unencrypted Social Security numbers and detailed job information creates significant long-term risk for affected personnel, even if the Pentagon has not yet seen misuse of the data.^{[1][4][5][9][10][11][13]} Such records can be weaponized for identity theft, targeted social engineering, and credential phishing that appears highly credible because it uses accurate details about an individual’s role and service history.^{[4][9][13][15]} Officials say the Department of Defense is providing one year of credit monitoring and identity protection resources, and letters sent to victims outline steps being taken by DMDC and the broader department to contain the breach and improve security.^{[2][5][8][14]}

For those notified that their data was involved, security experts recommend immediately enrolling in any offered credit monitoring, placing fraud alerts with major credit bureaus, and considering credit freezes where appropriate. Individuals should be wary of unsolicited emails, calls, or messages that reference military service or specific job roles, and treat such outreach as potential phishing even if it contains accurate personal details. Strong, unique passwords and multi-factor authentication across government, financial, and personal accounts can help reduce the chances that attackers can pivot from exposed DMDC data to successful account takeover or further compromise.

References

1. Pentagon breach exposed sensitive data on nearly 3 …
2. Pentagon Personnel Agency Data Breach Impacts 3 Million …
3. More than 3 million people affected by military data breach
4. Pentagon breach exposed unencrypted Social Security …
5. Reports: Pentagon Breach Exposes Nearly 3 Million Records
7. Pentagon Data Leak: Millions Of US Personnel Records Exposed In Nine-Month Security Breach
8. app.govly.com › public › signalsDoD Addresses DMDC Data Breach | Govly
9. Pentagon Data Breach Exposes SSNs and Military …
10. Hackers gained access to the data of nearly 3 million …
11. portal.vyprsec.aiVYPR — Vulnerability Intelligence
13. Pentagon Data Breach Exposes Military Personnel Information
14. US Defense Manpower Data Center Archives – Security Affairs
15. What to Know About the Pentagon Breach Affecting Millions