Pentagon Data Breach Exposes Personal Information of Three Million Individuals
The U.S. Defense Manpower Data Center (DMDC) has disclosed that a data breach has compromised the personal information of nearly three million individuals. This incident involved unauthorized access to one of its file-sharing servers for approximately nine months, prompting the agency to notify those affected.
According to DMDC, the breach impacts 2.76 million living individuals and 294,000 deceased individuals. The agency maintains extensive personnel records for the Department of Defense, which includes military and civilian personnel, contractors, family members, retirees, and veterans. The total number of records held by DMDC in fiscal year 2024 was reported to be around 60 million.
The breach was confirmed by a Defense Department official, who stated that the affected individuals potentially include current and former defense personnel or their dependents. The vulnerability that led to this breach was discovered on July 16, 2026, and it was quickly addressed by patching the system and restoring its functionality. An investigation revealed that unauthorized users accessed files between October 2025 and the date of discovery.
The files accessed contained unencrypted personal information, which varied by individual. In many cases, this included Social Security numbers (SSNs) along with other identifiers such as names, dates of birth, contact information, sex, race, and military personnel details, including occupational specialties.
Response Measures to the Breach
Following the discovery of the breach, DMDC initiated its privacy and cybersecurity incident response process in accordance with U.S. government policies. The agency is currently assessing the affected system and implementing measures to enhance its security protocols.
Cleared for Release
To assist those impacted, DMDC is offering 12 months of free credit monitoring through IDX, a company that specializes in data breach recovery services. Affected individuals are encouraged to reach out to IDX for any inquiries and to enroll in the monitoring service. Enrollment is available via a dedicated IDX website, and the deadline for registration is August 19, 2027. This credit monitoring service aims to help individuals detect any potential misuse of their personal information following the breach.
As of now, no cybercrime group has claimed responsibility for the attack, and DMDC continues to take steps to ensure the security of its systems and the protection of personal information.
