Pentagon breach exposes personal data of more than 3 million people

The Pentagon’s Defense Manpower Data Center (DMDC) is notifying millions of people that hackers gained access to their personal data.

The breach affects 2.76 million living individuals, a group that can include current and former defense personnel and their dependents, along with 294,000 deceased individuals, a Defense Department official told CNN.

Established in 1974, DMDC serves as a central hub for US Department of Defense data on military personnel, service status and benefits eligibility.

According to data breach notification letters shared online by affected individuals, DMDC discovered “a security vulnerability in a DMDC file sharing system” on July 16, 2026, which “allowed unauthorized users to access files.”

“Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII,” the letters say.

The exposed data differed from person to person and included Social Security numbers paired with names, birth dates, contact information, race, sex and military job specialties.

DMDC says it “does not have any indications of misuse of the accessed information,” and has not disclosed who accessed the files or whether they were copied.

“We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system,” the letters note.

DMDC is offering affected individuals 12 months of free credit monitoring through IDX, a breach response company contracted by the department.

This breach is the second blow to US federal agencies in a matter of weeks, after the ShinyHunters extortion group claimed it stole personal information of FBI employees.