Pentagon Personnel Data Center Breach Exposed Records of About 3 Million People Over Nine Months

A Pentagon agency that holds the personnel records of the U.S. military community left a door open for about nine months.

The Defense Manpower Data Center, known as DMDC, is notifying roughly 3 million people that unauthorized users accessed their personal information between October 2025 and July 2026. A defense official put the count at 2.76 million living individuals and 294,000 deceased individuals.

What was exposed

The DMDC found the problem on July 16, 2026, according to its notification letters to victims. The letters describe a security vulnerability in a DMDC file-sharing system that allowed unauthorized users to reach files. The files contained unencrypted personally identifiable information.

The exposed data varies by person. It includes Social Security numbers plus some combination of names, dates of birth, contact information, sex, race and military personnel details. In some cases it included a service member's "occupational specialty," according to the letter.

The DMDC says it patched the system immediately after discovery. The Pentagon says a "small number of unauthorized users" were involved.

Why the job data matters

Social Security numbers can be exploited for years. The occupational specialty field carries a different risk.

Justin Sherman, CEO of the advisory firm Global Cyber Strategies, said a bad actor could pair DMDC data with commercial datasets to learn about or even target defense personnel "based on their earnings, debts, marriages, spending habits, browsing activities, and worse." Combined with identifiers like Social Security numbers, job data could give a foreign adversary a clearer picture of who does what in the U.S. military and where.

That concern is not abstract. U.S. Central Command told lawmakers this spring that it had "received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater," as the U.S. fights a war with Iran.

The Pentagon's position

The department says it "does not have any indications of misuse" of the accessed data. A War Department official said the DMDC "immediately remediated the vulnerability" and initiated incident response in line with Office of Management and Budget and department policy. The DMDC also said it is taking steps to "assess and enhance the cybersecurity posture" of the system.

Affected people are being offered 12 months of free credit monitoring through IDX. They must enroll by August 19, 2027.

Absence of evidence of misuse is not the same as evidence of no misuse. Whoever had access for nine months has not been identified, and the Pentagon has not said what they did with the files.

Open questions about the lapse

The Pentagon has not publicly identified the file-sharing technology, the vulnerability or the people responsible. A Pentagon spokesperson did not immediately respond to CNN's question about who was behind it.

The DMDC maintains more than 60 million records on troops, civilian employees, contractors, retirees, veterans and family members. It is the central access point for benefits, entitlements and medical readiness data. It is also an agency whose systems are supposed to meet federal security standards.

TechTarget's analysis argued the breach "wasn't the result of a sophisticated cyberattack" but a failure of basic controls: encryption, access management and monitoring. That is an outside assessment, not a finding by the Pentagon. The Pentagon has not described how the intrusion occurred beyond calling it a vulnerability in a file-sharing system.

Nicholas Carroll, a cyber incident response manager at the security firm Nightwing, said stronger federal security "does not necessarily mean more mandates." In his words, it means "making sure the protections we already expect are consistently implemented, tested and maintained," and knowing "where sensitive information lives, who can access it, how it is protected and whether anyone is watching for suspicious activity."

A separate government breach

The disclosure came as the FBI dealt with its own incident. The extortion group ShinyHunters claims it stole several terabytes of data on "almost ALL FBI Agents" from the bureau's FBIjobs.gov site by exploiting an Oracle PeopleSoft zero-day. The group told BleepingComputer the breach was not financially motivated and that it does not plan to publish the data or extort the FBI.

No one has tied the FBI incident to the Pentagon breach.

What comes next

Military Times first reported the DMDC breach in late September, and ABC News carried the defense official's figures on September 28. The notification letters are still going out, and the enrollment window for credit monitoring runs through August 19, 2027.

The unanswered question is who held that access from October 2025 to July 2026, and whether the Pentagon can show what they took beyond what its letters list.