Pentagon Personnel Database Breach Hit 2.76 Million Living People; Separate Watchdog Report Faults $2.67 Billion Phone Contract

The Pentagon's main personnel database sat open to unauthorized users for about nine months, and the department has not said who they were.

A defense official has confirmed the numbers: 2.76 million living individuals and 294,000 deceased individuals were affected. The department said a Defense Manpower Data Center (DMDC) information system "experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026." Military Times first reported the breach in late September.

What was taken

Depending on the person, exposed records can include Social Security numbers, names, dates of birth, contact information and military personnel details, according to the Pentagon. A War Department official told Fox News' CyberGuy that the files were unencrypted.

In some cases, the data included a service member's occupational specialty, according to a breach notification letter from DMDC. The letter is dated September.

DMDC holds more than 60 million records on active-duty and reserve troops, civilian employees, contractors, retirees, veterans and family members. It is the central access point for benefits, entitlements and medical readiness data.

The Pentagon's account

Defense officials say DMDC remediated the vulnerability immediately after discovering it in July. They say they have no indication the data has been misused, and the department is offering identity protection and credit monitoring.

That is the department's own assessment. The access ran from October 2025 to July 2026, so the gap between intrusion and discovery was long. A Pentagon spokesperson did not immediately respond to CNN's question about who was responsible.

Why the job data matters

Social Security numbers are a lasting problem for anyone exposed. The occupational data is a separate one.

Justin Sherman, CEO of the advisory firm Global Cyber Strategies, told CNN that a bad actor could pair the stolen records with commercial datasets to "learn about or even target [defense personnel] based on their earnings, debts, marriages, spending habits, browsing activities, and worse." National security experts quoted by CNN described the data as potentially valuable to foreign intelligence services and to criminals seeking to extort personnel.

The warnings carry weight given the current conflict. US military leaders have repeatedly told troops their phones and accounts could be targeted during the war with Iran. US Central Command told lawmakers in the spring it had "received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater."

A separate watchdog finding on military phones

The breach is a different matter from a Pentagon inspector general report on the military's Spiral 4 wireless contract, valued at $2.67 billion. The report was detailed by PunchUp, the Daily Beast's sister Substack. The armed forces had more than 568,000 wireless lines in January.

The watchdog found the Pentagon failed to check whether the phone companies were adequately protecting data that could reveal troops' locations and contacts. It also found officials did not properly scrutinize the carriers' security assessments before exercising contract options.

The report warned that hackers could "map entire communication networks within the DoW, pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities." Investigators also found officials knew malicious actors could exploit known flaws to intercept and read SMS messages, yet the department "had not issued policy for protecting text messages."

The Pentagon did tighten the contracts after the Salt Typhoon intrusion, a Chinese state-linked hacking campaign against major U.S. phone networks. It now requires independent checks of carrier security, including tests to find weaknesses. The watchdog said officials still lacked a proper process for reviewing those results before renewing options.

The pressure for that fix began in December 2024. Democratic Sen. Ron Wyden and Republican Sen. Eric Schmitt wrote jointly to demand action after hackers reached call records and private conversations on AT&T, Verizon and T-Mobile networks.

Wyden said he remains worried. "I remain concerned that our servicemembers remain at risk from the military's insecure communications and look forward to seeing what else the Inspector General finds," he said. "I'll continue to watchdog DOD to make sure they follow through on the Inspector General's findings and finally secure their communications."

Other federal breaches

The Pentagon is not alone; last month the FBI told employees it is responding to a breach of its jobs portal, FBIJobs.gov. A threat actor said it would publish employee names, home addresses and Social Security numbers, sources told ABC News, and the bureau is operating as though every employee's information was compromised. The group, ShinyHunters, later told the New York Times and 404 Media it would not release the data.

What is still open

The Pentagon has not identified who accessed the DMDC system or whether any foreign government was involved. Nor has it said why an unencrypted system holding Social Security numbers went unnoticed from October to July. Wyden is waiting on further inspector general findings on the phone contracts.