Massive Pentagon hack sees records of 2.7 million US military personnel leaked during months-long data breach — names, military service records and Social Security numbers all revealed
A bug in a file-sharing service exposed sensitive employee data and allowed malicious actors to extract information on millions of people.
In a massive cyberattack, the Pentagon revealed that the personal information of 2.7 million current and former US military personnel was exposed due to an unpatched vulnerability in their file-sharing system. The stolen records contained sensitive details such as Social Security numbers, military roles, and personnel data, affecting both living individuals and deceased veterans.
The Department of Defense (DoD) manages the Defense Manpower Data Center (DMDC), which is responsible for collecting and maintaining personnel data. The breach went unnoticed for months before being confirmed through a Reddit post sharing a DMDC notification letter. The DMDC immediately patched the vulnerability once discovered, and the system was restored.
The investigation found that the attackers accessed servers containing unencrypted personally identifiable information (PII) in October 2025, extracting data between then and July 2026. The Department of Defense confirmed the breach, affecting 2.76 million living individuals and 294,000 deceased ones. While there are currently no indications of the files being misused, experts warn that the stolen information could be sold on the black market or used for targeted phishing attacks, potentially allowing cybercriminals to gain access to even more sensitive DoD servers.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
