5 minNews
Pentagon Data Breach Exposes Records of More Than 3 Million People
A breach at the Defense Manpower Data Center exposed unencrypted personal data, including Social Security numbers, of 2.76 million living individuals and 294,000 deceased individuals between October 2025 and July 2026.
The Pentagon has disclosed a major data breach at its Defense Manpower Data Center that exposed the personal records of more than 3 million people, including Social Security numbers, names, dates of birth, contact information and military personnel details.
A War Department official said 2.76 million living individuals and 294,000 deceased individuals were affected. The breach involved unauthorized access to personally identifiable information by a small number of unauthorized users between October 2025 and July 2026, according to the department.
The files that were accessed contained unencrypted personally identifiable information, creating a potentially long exposure window before the vulnerability was discovered. The department said DMDC immediately remediated the vulnerability after discovering it and that it has no indication at this time that the accessed information has been misused.
The Defense Manpower Data Center maintains more than 60 million records covering military personnel, civilian employees, contractors, family members, retirees and veterans. The agency uses those records to support benefits, identity verification and other Defense Department programs, meaning many people who left active military service years ago may still have information stored in its systems.
The military details in the exposed records make the breach particularly sensitive because they may reveal more than basic identity information. The specific data elements vary by individual, but can include Social Security numbers, names, dates of birth, contact information and military personnel details.
People whose information was accessed are being notified by postal mail through the department's contracted provider, Identity Theft Guard Solutions, also known as IDX. The department said IDX is providing notification, credit monitoring and identity restoration support based on the data elements affected for each individual.
Eligible individuals may receive 12 months of free credit monitoring and identity restoration support through IDX, depending on the information affected. Anyone with questions can visit the official IDX response page or call 1-855-744-4556.
Officials are urging recipients of breach notices to read them carefully rather than assuming they are junk mail. The letters should explain what information tied to each person was affected and what protection is being offered.
Security experts note that a Social Security number can remain useful to criminals for years, unlike a credit card number that can be canceled or a password that can be changed. Stolen Social Security numbers and dates of birth can be combined with other information collected elsewhere to open credit in a person's name or to craft convincing phishing attacks.
Recipients of official notifications should review the identity protection services available to them. Credit monitoring can warn about certain changes to a credit file, but it typically alerts after activity occurs and does not stop someone from attempting to use an identity.
For protection beyond the free 12-month period, individuals may consider a broader identity theft protection service. Placing a credit freeze with Equifax, Experian and TransUnion can also restrict access to a credit file, making it harder for someone to open a new credit account in a person's name. A freeze can be temporarily lifted when applying for credit.
The department is also warning the public to be cautious with unexpected emails or text messages claiming to be connected to the breach. Scammers often use major security incidents as an excuse to send fake notices or links designed to steal more information. Instead of clicking a link in an unexpected message, people should verify the information using the official IDX contact details or the postal notice they received.
7
