Overview
A breach of a Defense Manpower Data Center information system exposed personal information belonging to more than 3 mn people with ties to the U.S. military. The records included names, contact details, dates of birth, Social Security numbers, military job information and other personal data.
The breach affected about 2.76 mn living individuals and another 294,000 people who are deceased, according to a Pentagon official.
The specific information exposed differs by person, and officials said they have found no evidence so far that the data has been misused.
Unauthorized users accessed DMDC system for nearly a year
A small number of unauthorized users had access to the information between October 2025 and July 2026. A breach notice sent to one affected individual said DMDC discovered a security vulnerability in a file-sharing system on July 16 and immediately patched it.
The exposed information was stored without encryption, according to the Pentagon official. DMDC said it started privacy and cybersecurity incident response procedures after discovering the incident and is assessing additional measures for the affected system.
The Pentagon hasn’t disclosed who accessed the records or whether the intrusion was intentional. Officials also haven’t specified whether the affected individuals belong to a particular segment of the military community or explained why the personal information was stored on an unencrypted system.
DMDC holds more than 60 mn military-related records
The Defense Manpower Data Center manages identity verification for Department of Defense ID card holders and maintains more than 60 mn personnel records.
Its databases contain information covering troops and veterans, current and former civilian employees, contractors and military family members.
The scale of DMDC’s records makes the breach considerably larger than the number of people whose data was exposed. Pentagon officials have identified roughly 3.05 mn living and deceased individuals affected by the incident, compared with more than 60 mn records maintained by the organization.
Affected individuals receive 12 months of credit monitoring
The Defense Department is notifying people affected by the breach. IDX, a data breach and recovery services provider, will offer 12 months of credit monitoring to those whose information was involved.
DMDC has also been working during 2026 to correct records for hundreds of thousands of service members whose files lacked documentation required for Common Access Cards.
A Pentagon official previously said there was no indication of foul play in that separate records issue or evidence connecting it to a data breach.
