Pentagon confirms a data breach affecting 3.05 million people
Hackers had access to unencrypted Social Security numbers from October 2025 to July 2026. The Defense Department has not said who got in.
The U.S. Department of Defense confirmed that hackers gained access, between October 2025 and July 2026, to a server at the Defense Manpower Data Center (DMDC), where the Pentagon keeps its personnel records. The breach notice, which IDX hosts on the DMDC's behalf, promises affected people 12 months of credit monitoring.
The numbers came from a Defense official on September 29, according to Help Net Security: 2.76 million living people and 294 000 deceased, about 3.05 million in all. There is no public Defense document with those figures, and the notice consulted is published by the contractor, not by the Pentagon.
The way in was a vulnerability in the system the DMDC uses to exchange files, and from there the intruders reached a server holding unencrypted personal data. What was exposed is the Social Security number, the U.S. tax identifier, along with at least one other detail about the person, such as name, date of birth, contact information, sex, race or military specialty. The DMDC found the flaw on July 16, repaired it and brought the system back online. The first letters to those affected went out on September 18, according to Military Times.
What Defense has not said
The department has not identified the attackers, how many there were, or whether they copied the files. It speaks of "a small number of unauthorized users" and says it has no indication of misuse of the information, according to FedWeek. Spokesperson Susan Gough confirmed the figures but did not answer questions about the communications or the identity of those responsible, according to TechCrunch.
It has also not explained why more than two months passed between the discovery in July and the letters in September. An initial figure of about 4 million circulated on September 24, given to Military Times by two anonymous sources; the official one is lower.
How big the DMDC is
The center was founded in 1974 and holds more than 60 million records of military and civilian personnel, contractors, retirees, veterans and family members. TechCrunch sets it beside the 2015 data theft at the Office of Personnel Management (OPM), which reached more than 22 million U.S. government employees.
A Social Security number is hard to change and can be used to open accounts in someone else's name, which is why credit monitoring is the remedy Defense offers. No source indicates affected people in Mexico: the vast majority of the records belong to U.S. personnel.
