Military service members across the United States are being notified of a significant data compromise affecting the Pentagon's Defense Manpower Data Center (DMDC). The breach occurred within the department's human resources management infrastructure, with unauthorized access spanning from October 2025 through July 2026.
According to notification letters distributed to affected individuals, the DMDC stated that "a small number of unauthorized users" gained access to sensitive personal information after exploiting a vulnerability in file-sharing systems. The scope of the incident encompasses more than 3 million people, comprising nearly 2.8 million living individuals and 294,000 deceased individuals, Pentagon officials confirmed to Federal News Network.
The compromised data varies across affected parties but includes Social Security numbers, full names, dates of birth, contact details, sex, race, and military service records.
The DMDC responded to the incident by stating: "Upon discovery of the security vulnerability, DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of Management and Budget and Department guidelines and policies. We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system."
To address potential identity theft risks, the Pentagon is providing affected individuals with 12 months of complimentary credit monitoring through IDX, a data breach and recovery service provider. Those eligible must complete enrollment by August 19, 2027.
About the DMDC
Established in 1974, the DMDC functions as an operational support center for the U.S. Department of Defense. The organization maintains records for more than 60 million individuals, including military personnel, civilian employees, contractors, family members, retirees, and veterans. These records support authorization of benefits and entitlements, along with training, financial, and other administrative data. The center also manages DoD personnel programs and conducts research and analysis under direction from the Office of the Secretary of Defense.
According to the DMDC, "The services and access to data we provide support so many vital government entities, including the legislative branch, human services, national defense, labor, healthcare, finance, veterans affairs, research, and more."
Related Recent Incident
This breach follows another major incident involving the FBI. The ShinyHunters extortion group claimed responsibility for compromising FBIjobs.gov using an Oracle PeopleSoft zero-day vulnerability. The group stated it obtained several terabytes of data, including names, Social Security numbers, home addresses, and assignment information belonging to FBI agents and members of the FBI Remote Operations Unit, a division focused on hacking operations.
ShinyHunters informed BleepingComputer that the FBI breach was not motivated by financial gain and that the organization does not plan to publish the stolen information or demand ransom from the bureau.