Pentagon Breach Exposed Data on Nearly 3 Million
A monthslong security breach at one of the Pentagon’s central personnel databases exposed the sensitive personal information of nearly 3 million people, including Social Security numbers and details about the jobs they held, according to a U.S. defense official.
The breach of the Defense Manpower Data Center (DMDC) affected 2.76 million living individuals and another 294,000 who are deceased, the official told ABC News. Officials say there is no evidence so far that the exposed information has been misused.
What Was Exposed
According to the defense official, “a small number of unauthorized users” accessed the system between October 2025 and July 2026. A security vulnerability in a file-sharing system was discovered on July 16, 2026, and was immediately patched, the official said.
The compromised files contained unencrypted personally identifiable information, the type of which varies by individual. It includes Social Security numbers, names, dates of birth, contact information, sex, race, and military personnel information such as occupational specialty, or job details.
The DMDC serves as one of the Pentagon’s main repositories for personnel records, holding information on active-duty and reserve troops, civilian employees, contractors, retirees, veterans, and military family members. The agency maintains more than 60 million personnel records, based on fiscal year 2024 data.
“Upon discovery, DMDC immediately remediated the vulnerability,” the official said.
A Dispute Over Scale
The exact scope of the breach remains a point of contention. While the official cited 2.76 million living individuals, Military Times, which first reported the breach, said two people familiar with the incident estimated that approximately 4 million Defense Department personnel may be affected — a notably higher figure.
The breach came to light through a notification letter sent September 18, 2026, to at least one affected individual. The letter said DMDC discovered the vulnerability in a file-sharing system and that unauthorized users had accessed files on a server containing unencrypted data between October 2025 and the July discovery.
The department is offering those affected 12 months of credit monitoring and identity-restoration services through IDX, a private company contracted by the DoD, Federal News Network reported.
The Pentagon official declined to answer several questions about the incident, including who accessed the data, whether those affected belong to a particular group, whether the breach was intentional, or why personal information was stored on an unencrypted server.
Why the Job Data Matters
The sensitivity of the breach extends beyond Social Security numbers. The compromised files included details about the jobs performed by military and civilian personnel — information that raises counterintelligence concerns.
Knowing an individual’s occupational specialty can help hostile actors identify high-value targets or craft convincing, targeted phishing and social-engineering attacks. TIME reported that the length of the breach and the volume of exposed information make other security compromises easier for bad actors.
“It can be tempting to dismiss the next hack of a database as ‘just another data breach,’” Justin Sherman, a senior associate at the Center for Strategic and International Studies, wrote in a separate analysis cited by TIME. “But breaches do not exist in a vacuum.”
Part of a Broader Wave
The DMDC incident is the latest in a series of significant government data-security failures in 2026. It emerged as the FBI confirmed it is investigating a separate breach of its jobs portal, FBIJobs.gov, attributed to the criminal hacking group ShinyHunters, which has also been linked to the May 2026 hack of the education platform Canvas.
The hackers claimed to have stolen sensitive data on nearly all FBI agents and job applicants. A New York Times analysis found the breach may have involved home addresses, Social Security numbers, and job assignments. Reuters reported that some of the data revealed details of assignments to specific field offices and FBI units engaged in intelligence, security, and counterespionage work — a risk to national security.
In a statement to the New York Times and 404 Media, ShinyHunters claimed it would not release the FBI data as previously threatened. “Since the very beginning of this event we have unequivocally and assiduously emphasised this is NOT extortion, this is NOT ransom, this is NOT financially motivated,” the group said. ABC News has not independently verified the group’s claims.
The FBI said it is “working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted.”
The FBI breach followed a reported incident that may have exposed more than 153 million driver’s licenses in the United States and Canada, reported earlier in September.
What Happens Next
For those whose records were compromised, DMDC’s notification letter said the agency initiated privacy and cybersecurity incident response actions and is “taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system.”
Affected individuals can access yearlong credit monitoring through IDX. Security experts also recommend placing a free credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to prevent new accounts from being opened fraudulently.
Key questions remain unanswered, however. It is still unclear who was behind the DMDC breach, whether it was intentional, and whether the affected individuals belong to any particular group. Nor has any of the exposed data been confirmed as exfiltrated, sold, or used.
As investigators continue their work, the incident underscores a broader vulnerability: the vast troves of personal data that governments collect, and the difficulty of keeping them secure. As Sherman put it, breaches do not exist in a vacuum — and the consequences of this one may take months or years to fully surface.