3 Million Pentagon Personnel Records Sat on an Unencrypted File Server. Where Does Your CUI Actually Live?

The Pentagon agency that keeps the personnel records of the U.S. military has begun notifying more than 3 million people that their Social Security numbers and other personal details were exposed. The cause, according to the agency's own notice, was not an elaborate intrusion into a weapons program. It was a vulnerable file-sharing system sitting in front of a server full of unencrypted files. For defense contractors that handle Controlled Unclassified Information (CUI), the incident is a useful prompt to ask a plain question: where does that information actually live?

What the Defense Manpower Data Center Disclosed

The Defense Manpower Data Center (DMDC) maintains identity and personnel records for the Defense Department. According to a notification letter dated September 18 and first reported by Military Times, "a security vulnerability in a DMDC file sharing system" was discovered on July 16, 2026, "which allowed unauthorized users to access files." The letter, quoted by SecurityWeek, says that "between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII." Military Times reported that two defense officials confirmed the letter's authenticity.

The exposed information varies by person. According to the notice, it includes Social Security numbers along with at least one other identifier, such as name, date of birth, contact information, sex, race, or military personnel information including occupational specialty. The letter does not name the file-sharing product or describe the vulnerability. DMDC says it patched the system after the discovery, restored it, and began incident response actions under Office of Management and Budget and department guidelines.

How Many People Were Affected

Early reporting put the number at roughly 4 million: two people familiar with the incident told Military Times that about that many Defense Department personnel "may be affected," a figure Military.com noted was not a confirmed count. A Pentagon official later gave Federal News Network a more specific number: nearly 2.8 million living individuals and 294,000 deceased individuals, or more than 3 million people in total. SecurityWeek reported that a department official gave CNN the same figures, 2.76 million living and 294,000 deceased.

DMDC says it holds more than 60 million records covering military and civilian personnel, contractors, family members, retirees, and veterans. That figure describes the agency's total holdings, not the scope of this incident, and officials have not said which groups the affected individuals belong to.

The department says it has no indication that the information has been misused. It is offering 12 months of credit monitoring and identity restoration through IDX; BleepingComputer reported that enrollment is open until August 19, 2027. Several questions remain open. According to Federal News Network, the official declined to say who accessed the data, whether the access was intentional, or why personal information was stored on an unencrypted server. SecurityWeek reported that no known cybercrime group has claimed responsibility.

Why a File Share Matters to Contractors

The DMDC files were personal data held by a government agency, not contractor CUI, and the incident does not change any contractor's legal obligations. But the pattern is familiar to anyone who has scoped a CUI environment. Sensitive files tend to collect wherever it is convenient to put them: shared drives, email attachments, synced folders on laptops, and file-transfer tools set up for a single project and never retired. Each copy is another place that has to be protected, monitored, and accounted for.

Contractors that handle CUI under DFARS 252.204-7012 are required to implement the security requirements of NIST SP 800-171. Several of those requirements speak directly to the conditions described in the DMDC notice:

3.13.16: "Protect the confidentiality of CUI at rest."

3.13.8: "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards."

3.13.11: "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI."

3.1.3: "Control the flow of CUI in accordance with approved authorizations."

DFARS 252.204-7012 also says that if a contractor uses an external cloud service provider to store, process, or transmit covered defense information, the provider must meet security requirements equivalent to the FedRAMP Moderate baseline.

These obligations did not pause when the Department of War suspended CMMC Phase II on July 13, 2026. As law firm Dentons noted in its analysis of the announcement, the suspension delays third-party certification while the department reviews the program, but "the underlying NIST SP 800-171 safeguarding requirements applicable to many contracts remain in place."

Shrinking Where CUI Lives

The cheapest way to protect a file is often to have fewer places where it can be. The CMMC rule at 32 CFR 170.19 reflects that idea in how it scopes an assessment. CUI Assets, the systems that process, store, or transmit CUI, must meet the full set of requirements. Assets that are physically or logically separated from CUI can be treated as out of scope. The rule offers a specific example: an endpoint hosting a virtual desktop (VDI) client configured to allow nothing beyond keyboard, video, and mouse traffic to reach it is considered out of scope.

That is the logic behind an enclave: a defined environment where CUI work happens, with the rest of the company's systems kept outside the boundary. An enclave reduces the number of systems that must be protected. It does not remove the need to move files in and out, since CUI travels between primes, subcontractors, suppliers, and government customers. How those transfers are handled determines whether the boundary holds.

CloudFit Software, a managed CMMC compliance provider and a founding sponsor of Unbiased Headlines, offers one version of this approach. Its easyCMMC offering is a fully managed enclave built on Microsoft GCC High and Azure Government infrastructure. On October 13, CloudFit and Sharetru announced a partnership that pairs the easyCMMC enclave with Sharetru's managed file transfer service, which operates within a FedRAMP Moderate authorized boundary. According to the companies, external partners authenticate through Sharetru rather than being added to the contractor's Microsoft environment, administrators explicitly grant sharing permissions, and file-level audit activity is forwarded into Sentinel so security teams can monitor activity at the boundary. It is one approach among several on the market.

Questions Worth Asking This Week

The DMDC notice suggests a short inventory most contractors can start with records they already have. Which file shares, collaboration sites, and transfer tools currently hold CUI, and is each one inside your documented assessment scope? Is CUI encrypted at rest on every one of them with FIPS-validated cryptography, or only on some? When CUI goes to a subcontractor or a customer, which tool carries it, who approved that path, and where is the transfer logged? Are there old project shares or file-transfer accounts that nobody has reviewed in a year?

The department has not said how the DMDC vulnerability was exploited or who was behind it. For contractors, the lesson does not depend on those answers. The files were reachable because they were stored on a vulnerable system, and their contents were readable because they were not encrypted. Every copy of CUI is a place where those same two conditions can occur.

This article includes sponsored content from CloudFit Software, a founding sponsor of Unbiased Headlines. Statements about CloudFit's and Sharetru's services reflect the companies' stated positions; Unbiased Headlines has not independently verified every claim. This article is general informational content and does not constitute legal or compliance advice. Contractors should consult qualified legal counsel and a registered CMMC practitioner for guidance specific to their situation.

CloudFit Software is a founding sponsor of Unbiased Headlines. easyCMMC is CloudFit's managed CMMC Level 2 compliance offering, built on Microsoft GCC High and Azure Government infrastructure.