Unidentified attackers used a vulnerability in a file-sharing system at the Defense Manpower Data Center (DMDC) to access unencrypted personnel records for about nine months, from October 2025 until the flaw was found on July 16, 2026. The DMDC keeps the Pentagon's personnel records. A Defense Department official told CNN and ABC News that the breach affects 2.76 million living people and 294,000 deceased people. Defense Department spokesperson Susan Gough confirmed those figures to TechCrunch. Headline totals vary by outlet: "nearly 3 million" (ABC News), "roughly 3 million" (Nextgov/FCW) and "more than 3 million" (BleepingComputer, TechTarget). The official breakdown adds up to about 3.05 million. The notification letter itself gives no count (SecurityWeek). No source used here is a PRIMARY-tier document. Details of the letter come from copies that recipients posted online and that outlets obtained, and Military Times reported that two defense officials authenticated it.
What Happened
Military Times first reported the breach. Several outlets, including Nextgov/FCW, then obtained or reviewed the notification letter. It is dated September 18, 2026, and signed by DMDC Director Katie Griffin. Recipients posted copies online, including on the Reddit forum r/AirForce. The letter's timeline:
- October 2025: Unauthorized access begins. SecurityWeek and TechTarget say the access was to a file-sharing server. BleepingComputer calls it the Pentagon's human resources management system.
- July 16, 2026: DMDC discovers the vulnerability. According to the letter, DMDC "immediately updated the file sharing system to patch the vulnerability and the system was restored."
- After discovery: An internal analysis found that "a small number of unauthorized users accessed files on a server containing unencrypted PII" over the whole period.
- September 18, 2026: Notification letters are dated. Public reporting starts in the last week of September.
The letter says DMDC started incident response "in accordance with Office of Management and Budget and Department guidelines and policies" and is working to "assess and enhance the cybersecurity posture of the DMDC system." BleepingComputer reports that affected people are offered 12 months of credit monitoring through IDX and must enroll by August 19, 2027.
Nobody knows who did it. SecurityWeek found no criminal group claiming the attack. TechCrunch says the DoD would not answer whether officials had heard from the attackers.
What Was Taken
The letter describes the data as "accessed," while BleepingComputer and TechCrunch say it was "stolen." The fields exposed differ from person to person. They include:
- Social Security numbers. Stars and Stripes reports that each SSN was exposed together with at least one other field.
- Full names and dates of birth
- Contact information
- Sex and race
- Military occupational specialties and other service history
All of the data was stored unencrypted. On volume, every outlet cites the same official breakdown: 2.76 million living and 294,000 deceased. TechCrunch rounds these to "about 2.8 million" and "close to 300,000." The DMDC holds more than 60 million records in total, covering service members, civilians, contractors, family members, retirees and veterans. The breached set is therefore about 5% of its holdings. The DoD says it has found "no indications of misuse" so far.
Why It Matters
Counterintelligence exposure. CNN reports that national security experts are worried about counterintelligence risk. ABC News makes the same point about the job details in the files. When an SSN is linked to someone's military specialty, a foreign intelligence service can find people in sensitive roles, such as intelligence, cyber, special operations or nuclear specialties, and target them for recruitment, coercion or spear-phishing. This is the same kind of damage the 2015 OPM breach caused.
Records of deceased people are useful to attackers. The 294,000 records of deceased people can support synthetic identity fraud and benefits fraud, because nobody is checking those identities.
The victim is also an identity provider. TechCrunch notes that DMDC calls itself the military's "leading identity management provider." It links personnel to credentials such as Common Access Cards that are used to log into Pentagon networks. Nobody has reported that credential systems were affected. Still, a breach at the body that vouches for DoD identities raises the stakes.
Nine months without detection. Nextgov/FCW quotes ORION Security CEO Nitay Milner: "Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning." TechTarget calls it "a failure of fundamental security controls" (encryption, access management and monitoring) at an organization that helps set federal cybersecurity standards. Nextgov/FCW says the incident comes while the FBI is dealing with its own breach, and TechCrunch places it within "a spate of thefts involving federal workers' data."
The Attack Technique
What is confirmed is limited. Unauthorized users exploited a vulnerability in a DMDC file-sharing system and got read access to a server holding unencrypted PII. The DoD has not named the product, the vulnerability class or a CVE (SecurityWeek, TechTarget). No source says whether the flaw was a zero-day or a known bug that went unpatched.
Assessment: the details fit a pattern seen many times in 2023 to 2025, when attackers mass-exploited managed file transfer and file-sharing platforms such as MOVEit, GoAnywhere and Cleo to take bulk data quietly. That comparison is analysis, not something any source confirms. Accounts also disagree on scope. BleepingComputer frames it as a breach of the Pentagon's HR management system, while the letter and most other outlets describe one file-sharing server. Defenders should assume the narrower description until the DoD says more.
What Organizations Should Do
- Inventory and harden file-sharing and MFT platforms. Treat any file transfer or file-sharing system reachable from the internet as a high-value target. Patch on an emergency schedule, limit exposure to the internet, and subscribe to vendor advisories for every product in use.
- Encrypt sensitive data at rest, especially PII on staging and sharing servers. In this breach, plaintext files containing SSNs sat on a sharing server. Shared folders should not hold full record exports unless they are encrypted and set to expire.
- Monitor data-access behavior, not just the perimeter. Nine months without detection points to missing alerts on unusual file reads, bulk downloads and access from unexpected identities or places. Set baselines for normal use of file shares and alert when activity deviates.
- Minimize and purge. Keep the records of deceased individuals, and other data nobody needs to operate, out of systems people can reach. Data that isn't there can't be stolen.
- Harden personnel against targeting. Organizations whose staff appear in this dataset, such as defense contractors and units with sensitive specialties, should expect targeted phishing and social engineering that uses accurate personal details. Warn staff ahead of time and tighten identity checks on help desks and HR processes.
- Affected individuals: Sign up for the offered IDX monitoring (BleepingComputer reports a deadline of August 19, 2027). Freeze your credit with all three bureaus. Distrust unsolicited contact that cites your service details.
Sources: Pentagon personnel breach — undetected for months — renews ... | Hackers stole Pentagon personnel records of over 3 million people | Hackers stole millions of US military personnel records during mont... | Pentagon Personnel Agency Data Breach Impacts 3 Million ... | Pentagon breach exposes failure to follow its own standards TechTa... | Pentagon data breach of military personnel raises national security... | Pentagon breach exposed sensitive data on nearly 3 million people -... | Breach at Pentagon personnel database exposed data of millions Sta...