Key facts
- The notice says the personnel records were not encrypted. CNN, as relayed by Inshorts, reported that the Pentagon admitted this. It is unclear why the data was unencrypted.
- A Pentagon official told Federal News Network that about 2.8 million living people and roughly 294,000 deceased people were affected, which is over 3 million in total. DoD spokesperson Susan Gough confirmed the numbers.
- The notice describes the intruders as plural; BleepingComputer quotes it as 'a small number of unauthorized users'. Their identities are not known.
- DMDC says it began incident response on discovery of the vulnerability, following OMB and Department guidelines, and is assessing and improving the system's security posture.
A breach affects more than 3 million people, living and deceased, according to a Pentagon official quoted by Federal News Network. The Defense Manpower Data Center (DMDC) is notifying current and former US military personnel and staff that their personal data was stolen, TechCrunch and BleepingComputer report.
That official put the toll at about 2.8 million living people and roughly 294,000 deceased people. Department of Defense spokesperson Susan Gough confirmed the numbers, according to TechCrunch and BleepingComputer.
A months-long window
Per the DMDC notification, a small group of people without permission took advantage of a flaw in a file-sharing system that the notice does not name. TechCrunch and BleepingComputer report that the activity ran from October 2025 until mid-July 2026.
BleepingComputer quotes the notice as describing “a small number of unauthorized users.” TechCrunch reports that their identities are not known.
What was exposed
The exposed data varies by person. TechCrunch says it includes Social Security numbers, names, dates of birth, sex, race and military service information. BleepingComputer also lists contact information.
TechCrunch reports that the notice says the personnel records were not encrypted, meaning they were not scrambled in a way that requires a key to read. CNN, as relayed by Inshorts, reported that the Pentagon admitted this. TechCrunch says the reason for the lack of encryption is unclear.
Scope and the department's response
BleepingComputer reports that DMDC holds more than 60 million records on military, civilian, contractor and family members, used for benefits, and serves as the military’s identity management provider. TechCrunch reports that only a file transfer system appears to have experienced a breach, which may have limited the scope.
TechCrunch reports that the Department of Defense says it has no evidence that anyone misused the information, but it did not explain how it reached that conclusion. The department also did not answer questions about contact from the hackers.
BleepingComputer reports that DMDC says it began incident response when it found the flaw, following Office of Management and Budget and Department guidelines. The center says it is assessing and improving the system’s security posture.
The dwell time, and related incidents
The newsletter This Week In Security puts the period before detection at about nine months, with access cut in July 2026 and notices following in the next weeks. Its author argues that logging and monitoring could have flagged the activity sooner. That is the author’s analysis, not an established finding.
The breach followed an FBI personnel data breach in September 2026 that the ShinyHunters group claimed. TechCrunch says the group states it will not publish the data or extort the bureau, and describes the two incidents as almost certainly separate.
TechCrunch and This Week In Security point to the 2015 Office of Personnel Management breach as the usual precedent. It exposed records of more than 22 million federal employees and was broadly attributed to China.
What affected people are being offered
BleepingComputer reports that the Pentagon is offering 12 months of free credit monitoring through IDX. Affected people must enroll by Aug. 19, 2027.
Join the discussion