Pentagon personnel data breach exposed Social Security numbers of about 3.05 million people
A flaw in a Pentagon personnel file-sharing system exposed unencrypted Social Security numbers of about 3.05 million people, living and deceased, from Oct 2025 to July 2026. Fixed. Use the free IDX credit monitoring offered in your letter and consider a credit freeze.
If you get a DMDC letter, sign up for the free IDX credit monitoring and consider a credit freeze. Be wary of calls or emails about it. If you have served or had a family member in the military, you can ask the Defense Department whether you were affected.
What’s happening
The Defense Manpower Data Center (DMDC), which holds US Defense Department personnel records, found a security vulnerability in one of its file-sharing systems on 16 July 2026. Unauthorised users could reach files on a server holding unencrypted personal information between October 2025 and that date. Exposed details varied by person but included Social Security numbers plus other identifiers such as name, date of birth, contact details, sex, race or military job specialty. A defense official put the total at 2.76 million living and 294,000 deceased people, about 3.05 million. Early reports from people familiar with the matter had suggested about four million, which the department did not confirm. The department says a small number of unauthorised users accessed the data and it has no sign of misuse. It has not said who they were or whether files were copied. DMDC patched the system. Letters went out from 18 September, offering 12 months of credit monitoring through IDX. As of the pages read, no charges, lawsuits or investigations were reported.
- What
- Breach
- Affects
- US Defense Manpower Data Center (DMDC) personnel file-sharing system
- Fixed in
- Nothing to patch
- Since
- 24 Sept 2026
- Closed
- 1 Oct 2026
Timeline
- Update
Help Net Security reported DMDC has not said who the unauthorised users were or whether they copied the files, and that it is working to strengthen the system's security. No lawsuits, investigations or other later developments were reported in the pages read.
- Update
A defense official confirmed 2.76 million living and 294,000 deceased people were affected (about 3.05 million), that a small number of unauthorised users accessed the data, and that the vulnerability was remediated immediately after discovery. ABC News reported this.
- Update
Military Times reported the breach. Two people familiar with it said about four million people might be affected, a figure the department had not confirmed. Two defense officials confirmed the letter was genuine.
- Update
DMDC sent notification letters to affected people, offering one year of credit monitoring and identity-restoration services through IDX. The letter says the department has no sign the data has been misused.
- Made publicFixed
The Defense Manpower Data Center (DMDC) found a security vulnerability in one of its file-sharing systems. Its later notification letters say unauthorised users could reach files on a server holding unencrypted personal information from October 2025 up to that date. DMDC patched the system and restored it.
Sources
- Military personnel data exposed in breach, agency warnsMilitary Times · 24 Sept 2026
- Pentagon breach exposed sensitive data of 3 million peopleABC News · 28 Sept 2026
- Pentagon breach exposes personal data of more than 3 million peopleHelp Net Security · 1 Oct 2026