Pentagon confirms data breach affecting 3 million military records

The Department of Defense has confirmed a significant cybersecurity breach involving the Defense Manpower Data Center (DMDC). Unauthorized users maintained access to a file-sharing system for approximately nine months, between October 2025 and July 16, 2026, before the vulnerability was patched.

The breach exposed the personal records of roughly 3 million individuals, including 2.76 million living people and 294,000 deceased individuals. The compromised data included unencrypted Social Security numbers, names, birth dates, contact details, race, sex, and military occupational specialties. The DMDC serves as a central identity repository, managing approximately 60 million records for service members, civilian employees, contractors, retirees, veterans, and their families.

While Pentagon officials stated there is no evidence of data misuse, the duration of the undetected access has raised concerns regarding the security of sensitive personnel information. The exposure of military occupational specialties is noted as a particular risk, as it could potentially allow foreign intelligence agencies to identify personnel of strategic value.