Hackers Stole Millions of US Military Personnel Records During Months-Long Data Breach

Hackers infiltrated the Defense Manpower Data Center over a period of months, gaining access to sensitive personal information belonging to around 2.8 million living and deceased U.S. military personnel and staff. The attackers exploited a file-sharing vulnerability between October 2025 and July 2026, obtaining unencrypted records containing Social Security numbers, dates of birth, demographic details, and military service information.

According to TechCrunch, the DMDC, a critical component of the Department of Defense, maintains over 60 million records for U.S. military and civilian staff and their families to determine entitlements like healthcare and retirement benefits. The DMDC also serves as the military's primary identity management provider, issuing credentials such as smart cards and passwords to access Pentagon systems, buildings, and bases.

The unit emphasizes the paramount importance of security in protecting this information. While the Department of Defense stated they have no evidence of misuse, they did not elaborate on how they reached this conclusion. Attempts to reach a Pentagon spokesperson for comment on potential communications from the hackers, whose identities remain unknown, were unsuccessful.