Hackers stole millions of US military personnel records during months-long data breach

A recent data breach at the Pentagon’s personnel records has exposed sensitive information of millions of current and former U.S. military personnel and staff. The breach, which occurred between October 2025 and mid-July 2026, was caused by unauthorized users exploiting a security vulnerability in an unspecified file-sharing system.

The Defense Manpower Data Center (DMDC), responsible for maintaining over 60 million records for U.S. military and civilian staff, revealed that the breach affected approximately 2.8 million living individuals and nearly 300,000 deceased personnel. The exposed data includes Social Security numbers, names, dates of birth, sex, race, and military service details.

Crucially, the records were unencrypted, putting the information at risk of misuse. The DMDC, which also serves as the military’s identity management provider, stated that they have not received any indication that the stolen data has been misused. However, cybersecurity experts warn of the potential for foreign governments to exploit the information for targeted coercion or blackmail.

This breach follows a series of recent data thefts involving federal workers’ personal information, including a breach at the FBI in early September, allegedly carried out by the ShinyHunters hacking group. The ShinyHunters group has confirmed the theft of FBI personnel data but maintains that they will not release it publicly. The repeated breaches of government personnel records raise concerns about the security of sensitive information in the federal government and the potential consequences of such breaches.