Pentagon breach exposed records of nearly 3 million service members
Intruders used a flaw in a file-sharing system for months before the Defense Manpower Data Center found it. Social Security numbers were among the data taken.
The US Department of Defense has begun notifying current and former service members that their personal information was stolen in a breach that ran for months. A Pentagon official said it affects about 2.8 million living people and close to 300,000 who have died.
What happened
Unauthorised users exploited a vulnerability in a file-sharing system between October 2025 and mid-July 2026. The Defense Manpower Data Center (DMDC), which holds personnel records for the department, discovered the flaw on 16 July and says it fixed it immediately.
The exposed data includes Social Security numbers alongside names, dates of birth, sex, race and details of military service, according to Time, and reports say the records were not encrypted. Defence officials say they have found no evidence so far that the information has been misused, and are offering identity protection and credit monitoring.
The lesson
Two details stand out for any public body that holds personal data at scale: the months between the first intrusion and its discovery, and sensitive records sitting unencrypted in a system reachable through a file-sharing tool. Federal News Network puts the total affected, living and dead, at more than 3 million.
Research desk, Online
Stories by the IQGov research desk are written from public documents, official data and on-record statements, which are listed and linked at the end of each piece.
