The Defense Manpower Data Center (DMDC), the Pentagon's main personnel records and identity management unit, is notifying current and former service members that unauthorized users had access to their personal data for about nine months. Attackers exploited an unnamed vulnerability in a DMDC file-sharing system between October 2025 and July 16, 2026, and reached a server holding unencrypted personally identifiable information (PII), including Social Security numbers. The DMDC's own notification letter gives no victim count. A Defense Department official told CNN and Federal News Network that 2.76 million living individuals and 294,000 deceased individuals were affected, about 3.05 million in total. Outlets round this differently: "roughly 3 million" (Nextgov/FCW), "about 2.8 million living" and "close to 300,000" deceased (TechCrunch), and "more than 3 million" (Federal News Network, ICT Network News). No one has identified the attackers, and no known cybercrime group has claimed the intrusion, according to SecurityWeek.
What Happened
The breach became public through notification letters that recipients posted online, including on Reddit, before the Pentagon commented on the record. SecurityWeek reports that the letter is dated September 18, 2026. Nextgov/FCW obtained a copy signed by DMDC Director Katie Griffin.
The timeline in the letter, which several outlets quote:
- October 2025: Unauthorized access begins. The letter says that "a small number of unauthorized users accessed files on a server containing unencrypted PII."
- July 16, 2026: DMDC finds "a security vulnerability in a DMDC file sharing system." The letter says DMDC "immediately updated the file sharing system to patch the vulnerability and the system was restored."
- September 18, 2026: Notification letters are dated (per SecurityWeek).
- Late September 2026: CNN first reports the breach on September 25. A Pentagon official confirms the victim counts to CNN and Federal News Network, and DoD spokesperson Susan Gough confirms the figures to TechCrunch.
DMDC says it began privacy and cybersecurity incident response "in accordance with Office of Management and Budget and [Defense] Department guidelines and policies" and is "taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system."
The letter says that "DoW does not have any indications of misuse of the accessed information." The Pentagon official repeated this to Federal News Network. Federal News Network also reports that IDX will provide 12 months of credit monitoring to affected people.
The Pentagon has declined to answer most questions. According to Federal News Network and TechCrunch, these include who accessed the data, whether the access was deliberate, whether the attackers have contacted officials, whether any particular group was targeted, and why the data sat on an unencrypted server.
What Was Taken
The exposed fields differ from person to person. Across the letter and the reporting, they include:
- Social Security numbers
- Full names
- Dates of birth
- Contact information
- Demographic data, including sex and race (TechCrunch, ICT Network News)
- Military personnel information, including military occupational specialties and service history
Every source agrees that the records were unencrypted at rest.
The figure of about 3.05 million people is small next to DMDC's total holdings. According to DMDC's website, cited by SecurityWeek and TechCrunch, the agency held at least 60 million records as of fiscal year 2024. Those records cover active-duty members, civilian staff, contractors, dependents, retirees and veterans. CNN notes that the "living individuals" category could include dependents as well as current and former personnel. For comparison, TechCrunch notes that the U.S. military had 1.3 million active service members as of March. This suggests that most of the people affected are former members, dependents or civilians, though the Pentagon has not given a breakdown.
Why It Matters
Counterintelligence exposure. CNN reports that national security experts have raised counterintelligence concerns. A dataset that pairs SSNs and dates of birth with job specialties lets an adversary pick out people in sensitive roles and build social engineering, recruitment or coercion campaigns aimed at them. It is the same risk created by the 2015 OPM breach, and it remains whether or not the data is ever sold.
Identity infrastructure adjacency. TechCrunch notes that DMDC is the military's "leading identity management provider." It links service members, employees and contractors to credentials such as Common Access Cards and passwords that grant access to Pentagon systems. No source says that credential systems were touched. Still, an intrusion into the agency that runs DoD identity raises the stakes of any follow-on phishing or credential attacks against the people in these records.
Detection failure. The attackers had about nine months of access before anyone noticed. Nextgov/FCW quotes ORION Security CEO Nitay Milner: "Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning." TechTarget argues the incident "wasn't the result of a sophisticated cyberattack" but a failure of basic controls (encryption, access management and monitoring) at an organization that helps set federal security standards.
Pattern of federal personnel data theft. TechCrunch calls this the latest in "a spate of thefts involving federal workers' data," and Nextgov/FCW notes that the FBI is handling its own breach at the same time. Federal personnel data is still a top target.
The Attack Technique
What is known is limited. Attackers exploited a vulnerability in a DMDC file-sharing system to reach files on a server holding unencrypted PII. The Pentagon has not named the file-sharing product, described the vulnerability, or said whether it was a zero-day or a known, unpatched flaw. SecurityWeek and TechTarget both note these gaps. The letter refers to "a small number of unauthorized users," and that wording does not show whether a single actor or several separate actors were involved.
Several points remain unknown. The attackers have not been identified. There is no public evidence of a data-leak listing or an extortion demand. It is also unclear whether the access was detected through internal monitoring or found during an unrelated review of the vulnerability.
Analyst note: managed file transfer and file-sharing platforms have been among the most heavily exploited categories for bulk data theft in recent years. Long dwell time combined with quiet exfiltration and no public extortion fits both espionage and opportunistic mass exploitation. Until DoD releases details, attribution should stay open.
What Organizations Should Do
- Inventory and harden file-sharing and MFT systems. List every internet-reachable file transfer and sharing platform, apply vendor patches quickly, and remove or restrict access to instances that are not needed. These are high-value edge systems and should be patched like VPNs and firewalls.
- Encrypt sensitive data at rest and limit what file servers hold. Bulk SSN and personnel data should not be stored unencrypted on a server that a file-sharing application can reach. Apply field-level encryption or tokenization, and keep the data on shared file stores to the minimum needed.
- Close the detection gap. Alert on unusual file access volume, new or rare service accounts touching sensitive directories, and large outbound transfers from file-sharing hosts. Nine months of dwell time points to missing or unmonitored audit logging.
- Hunt retroactively after any file-sharing CVE. When a flaw in a platform you run is disclosed, patching is not enough. Review access and transfer logs back to the earliest plausible exploitation date.
- Prepare affected personnel for targeted phishing. If your workforce includes veterans, reservists, defense contractors or military family members, warn them about phishing that uses their service details, and tighten verification for helpdesk and credential reset requests.
- Advise individuals to freeze credit. People affected should take the offered monitoring, but they should also place free credit freezes with all three bureaus and request an IRS Identity Protection PIN, since SSNs and dates of birth do not expire.
Sources: Hackers stole Pentagon personnel records of over 3 million people... | Pentagon personnel breach — undetected for months — renews cyber st... | Hackers stole millions of US military personnel records during mont... | Pentagon Personnel Agency Data Breach Impacts 3 Million ... | Pentagon breach exposes failure to follow its own standards TechTa... | Pentagon data breach of military personnel raises national security... | More than 3 million people affected by military data breach - Feder... | What to Know About the Pentagon Breach Affecting Millions