Pentagon DMDC Breach Exposed Personal Data of More Than 3 Million Military Personnel
The Defense Manpower Data Center said a file-sharing vulnerability discovered on 16 July 2026 allowed unauthorized access from October 2025 to July 2026 to unencrypted personal data on 2.76 million living people and 294,000 deceased people. Exposed records included Social Security numbers and other identifiers for current and former US military personnel and family members.
The US Department of Defense personnel system suffered a data breach in which Social Security numbers and other personal information of large numbers of current and former service members were exposed, raising counterintelligence concerns among national security specialists, according to reporting summarized on 30 September 2026.
Scope of the DMDC incident
A Defense Department official told CNN on Monday, 28 September 2026, that the breach involved 2.76 million living persons and 294,000 deceased persons. Living persons may include current and former Defense personnel and their family members.
The incident was first reported by media on 25 September 2026. In notification letters to affected people, the Defense Manpower Data Center (DMDC) said that on 16 July 2026 it found a security vulnerability in a DMDC file-sharing system that allowed unauthorized users to access files. DMDC said it immediately updated the file-sharing system, patched the vulnerability, and then restored operations.
From October 2025 through July 2026, a small number of unauthorized users accessed files on a vulnerable computer server at the center. The server stored unencrypted personally identifiable information (PII).
Exposed data varied by person. For some affected individuals, the information included Social Security numbers (SSN) and at least one other identity element, such as name, date of birth, contact details, gender, race, and military occupational information such as specialty.
The Pentagon did not detect and repair the vulnerability until nine months later, in July 2026.
DMDC's website describes the center as the Department of Defense's unified service platform for service members, veterans, and family members to query benefits, related entitlements, and medical readiness information. As of fiscal year 2024, the center maintained at least 60 million records.
The stolen data were not encrypted. Notification letters said DMDC is taking appropriate steps to assess and strengthen the cybersecurity posture of DMDC systems. DMDC will provide one year of credit monitoring to affected people.
No confirmed public abuse, counterintelligence concern remains
The Pentagon currently has found no indication that the leaked data have been abused. Specialists said the dataset could still be valuable to foreign intelligence services for tracking US military personnel, and could be used for extortion if obtained by cybercriminals.
Some intruders obtained occupational specialty information. Specialists said that, combined with other data, foreign adversaries could further identify US service members and their roles. Identifiers such as Social Security numbers could be used to correlate records and learn what US military personnel do in various locations.
The party behind the breach remains unidentified. A Pentagon spokesperson did not immediately respond to CNN questions about attacker identity.
US military leaders have repeatedly warned that during conflict with Iran, service members' phones and online accounts may be targeted. In spring 2026, US Central Command, which covers the Middle East and surrounding regions, told members of Congress it had received multiple threat reports that adversaries might use commercial location data to attack or surveil US personnel in theater.
Justin Sherman, chief executive of consulting firm Global Cyber Strategies, said malicious actors could correlate DMDC information with other commercial data, including income, debt, marital status, spending, and browsing activity, to learn more about Defense personnel and to target them. Sherman told CNN that a possible leak of personal data on millions of service members is itself dangerous in a period of US conflict with Iran and competition with several other countries. He said that if a foreign adversary obtained data at that scale, it could use the data for phishing, profiling, foreign intelligence recruitment, and other attacks.
Source: https://edition.cnn.com/2026/09/25/politics/pentagon-data-personnel-breach