Pentagon confirms breach affecting more than three million

The Pentagon has confirmed a security breach affecting over three million people, exposing sensitive personal data stored within the Defense Manpower Data Center (DMDC) information system. According to a US defense official, the breach affected 2.76 million living individuals and approximately 294,000 deceased individuals, exposing Social Security numbers, personnel information, and additional identifying details.

The compromised files, stored on a vulnerable file-sharing server, contained unencrypted data and were accessed by unauthorized users between October 2025 and July 2026. The DMDC discovered the vulnerability on July 16, which had allowed unauthorized access to the files for nine months prior to discovery. The breach exposed sensitive information, including names, dates of birth, contact information, sex, race, and military occupational specialties.

The Pentagon has not identified the unauthorized users or disclosed their motive, nor has it confirmed whether the exposed information has been misused for fraud or other malicious purposes. Affected individuals were notified in September 2026 and offered one year of credit monitoring and identity restoration services. The incident highlights the sensitivity of the information handled by the DMDC, which supports various personnel and readiness operations, manpower analysis, benefits eligibility, and medical treatment registrations.

The Pentagon stopped short of assigning responsibility for the breach and emphasized that the monitoring measures in place did not generate warnings during the period of unauthorized access.