Pentagon Data Breach Exposes Personal Information of 3.05 Million Military Personnel and Dependants

The US Department of Defense has confirmed a breach at its Defense Manpower Data Center (DMDC), one of the military's primary repositories of personnel information, affecting approximately 3.05 million people. The disclosure, which became public through breach notification letters dated September 18, reveals that a small number of unauthorized users had been accessing files containing unencrypted personally identifiable information since around October 2025.

DMDC discovered the security vulnerability on July 16, 2026, and says it immediately patched the flaw and restored the system. The subsequent investigation determined the breach affected 2.76 million living individuals and roughly 294,000 deceased former defence personnel or their dependants. The exposed information includes personal identifiers, though the Pentagon has not released a detailed breakdown of exactly which data fields were compromised.

Affected individuals are being offered 12 months of free credit monitoring and identity-restoration services through IDX, a contractor working with the Department of Defense. Enrolment is available through a dedicated website using a code included in the notification letter, with a deadline of August 19, 2027.

As of October 1, 2026, the department has not named a responsible party, published a full technical root-cause analysis, or confirmed whether a criminal or congressional investigation has formally opened. The breach is smaller than the 2015 Office of Personnel Management incident, which exposed roughly 22 million records including fingerprints and security-clearance background files, but the involvement of a federal defence agency and the duration of unauthorized access — nearly nine months before discovery — adds a serious national-security dimension to what is already a significant data exposure event.