Pentagon breach exposed 2.76 million military records with unencrypted data

A nine-month breach of the Defense Manpower Data Center (DMDC), a Pentagon personnel database, compromised the records of approximately 2.76 million living individuals and 294,000 deceased persons between October 2025 and July 2026. Unauthorized users accessed unencrypted personally identifiable information including Social Security numbers, names, dates of birth, addresses, demographic details, and military occupational specialties. The DMDC maintains over 60 million records covering active-duty and reserve military members, civilian employees, contractors, retirees, veterans, and military family members.

The Pentagon discovered the vulnerability in mid-July 2026 and immediately patched the affected file-sharing system. A U.S. defense official stated: "A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. Upon discovery, DMDC immediately remediated the vulnerability." Defense officials reported finding no evidence that the exposed data has been misused as of the breach's discovery.

Security experts and analysts highlighted two distinct risk categories arising from the breach. First, Social Security numbers and contact information create persistent identity fraud risks that cannot be mitigated by resetting credentials, as these identifiers generally cannot be changed. Second, the combination of military occupational specialties with personal information may enable foreign adversaries or threat actors to identify high-value military and civilian personnel for targeted social engineering, espionage recruitment, or operational security threats.

The breach represents the second major compromise of U.S. federal personnel records in recent months, following a September 2026 breach of the FBI's jobs portal (FBIJobs.gov) attributed to the ShinyHunters hacking group. The DMDC breach also echoes the 2015 Office of Personnel Management breach, widely attributed to China, which exposed records of over 22 million U.S. government employees. The Pentagon and Defense Department have not publicly identified the attackers responsible for the DMDC breach or disclosed how the vulnerability was discovered. Affected individuals are being offered up to one year of credit monitoring and identity protection services.