Pentagon Personnel Database Breach Exposes Data of Nearly 3 Million People

The Pentagon's Defense Manpower Data Center, known as DMDC, has notified current and former military and civilian personnel that their personal information was exposed in a data breach that went undetected for months. The agency, which maintains personnel records for the Department of Defense, said it discovered a vulnerability in a file-sharing system on July 16, 2026.

According to the notifications and subsequent reporting, unauthorized users were able to reach files on the affected server between October 2025 and the July 16 discovery date. DMDC says the exposed records covered about 2.76 million living individuals and roughly 294,000 people who have died, putting the total number of affected records near 3 million.

The files reportedly contained unencrypted Social Security numbers paired with names, dates of birth, contact information, race, sex and military job specialties. Storing that kind of identifying information without encryption is widely considered poor practice for a system of this size and sensitivity.

DMDC says it patched the vulnerability and restored the system after discovering the intrusion, then began its standard privacy and cybersecurity incident-response process. Formal notification letters to affected individuals went out starting September 18, 2026, roughly two months after the flaw was found.

The department is offering affected people one year of free credit monitoring and identity-restoration services through IDX, a contractor the DoD has used for past breach responses. DMDC has said it currently has no indication that the exposed data has been misused, but it has not disclosed who accessed the files or whether the information was copied or downloaded.

The incident adds to a long list of breaches affecting U.S. government personnel systems in recent years and renews questions about how sensitive records, including Social Security numbers, are stored and protected across federal agencies. For the millions of service members, veterans and civilian employees affected, the practical risk is the same one that follows any large identity-data leak: a lasting exposure to fraud and identity theft that credit monitoring can only partly offset.