The Pentagon has now put a number on a breach at the Defense Manpower Data Center (DMDC), the unit that keeps personnel records for the Defense Department: about 2.76 million living people and roughly 294,000 deceased people, or about 3.05 million in total. Each affected record included a Social Security number, and the files were not encrypted.
What happened
According to Military Times, DMDC discovered a security vulnerability in a file-sharing system on July 16, 2026. Unauthorized users could reach files holding personal data from about October 2025 until then, a window of roughly nine months. DMDC says it patched the system and restored it. Notification letters are dated September 18, and Military Times says two defense officials confirmed that a copy of the letter is authentic.
Reporting from Fox News and TechCrunch on September 30 added the headcount, which a Pentagon official gave to news outlets. Fox News reports the department describes the intruders as a small number of unauthorized users.
Who is affected and what was exposed
DMDC holds more than 60 million records covering service members, civilian employees, contractors, family members, retirees and veterans, so the affected group is not limited to people on active duty. The notice says each person’s Social Security number was exposed together with at least one other identifier, such as a name, date of birth, contact details, sex, race, or military details like occupational specialty. The deceased individuals are former personnel or their dependents, so surviving family members may also receive letters.
The department says it has no indication the information has been misused. TechCrunch notes that it did not explain how it reached that conclusion. Because a Social Security number does not change, even a breach with no known misuse can create risk years later.
What DMDC is offering
Letters are going out by mail through IDX, a contractor hired by the Defense Department. They offer one year of credit monitoring and identity restoration services, according to Military Times.
What to do
The steps below are our analysis, not instructions from DMDC.
- Enroll in the offered monitoring using the contact details printed on your letter. Do not click links in unexpected emails or texts about the breach, because scammers use breach news.
- Freeze your credit at Equifax, Experian and TransUnion. A freeze is free and blocks new accounts opened with your Social Security number. A one-year monitoring offer is short for data that does not expire.
- Pull your free credit reports at annualcreditreport.com and look for accounts you do not recognize.
- Consider an IRS Identity Protection PIN to block fraudulent tax returns filed in your name.
- If a relative who has died may be affected, check whether a letter arrived for them and ask the credit bureaus how to flag the file as deceased.
What we still do not know
The Defense Department has not said who the unauthorized users were, how they got in, whether the data was copied or sold, or which file-sharing product was involved. It also has not explained how it concluded there is no sign of misuse. Reports have differed on whether the data was merely exposed or stolen; the notice itself uses the language of exposure and access.
Sources: Military Times, Sept 24, 2026; Fox News, Sept 30, 2026; TechCrunch, Sept 30, 2026.
Leave a Reply