It revealed the names, dates of birth, Social Security numbers, job specialties and other records of nearly 2.8 million living and 294,000 deceased individuals.
A breach of the Defense Manpower Data Center’s information system exposed the personal information of more than 3 million people with ties to the U.S. military, a Pentagon official told Federal News Network on Monday.
A “small number of unauthorized users” had access to the data for nearly a year, from October 2025 to July 2026, the official added. A notice sent to one affected person said a security vulnerability in a file-sharing system was discovered July 16 and was immediately patched.
The incident revealed the unencrypted names, contact information, dates of birth, Social Security numbers, military jobs and other records of nearly 2.8 million living individuals and 294,000 who are deceased, the official said. The type of data exposed varies by person.
“DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of Management and Budget at department guidelines and policies,” the notice says. “We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system.”
There’s no indication that anyone’s personal information has been misused, the Pentagon official said. IDX, a data breach and recovery services company, will provide 12 months of credit monitoring for those affected.
The official declined to answer several questions about the incident, including who accessed the data, whether those affected belong to a particular group, whether the breach was intentional or why personal information is stored on an unencrypted server.
DMDC oversees identity verification for all DoD ID card holders. It maintains the records of more than 60 million troops and veterans, current and former civilian employees, contractors and military family members.
Federal News Network recently reported the organization has worked all year to update the files of hundreds of thousands of troops that are missing the right documentation to hold a Common Access Card, which provides access to military installations and computer networks. A Pentagon official said Sept. 3 there’s no indication that foul play was involved or that the issue enabled a data breach.
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
