Pentagon Data Breach Exposes Personal Records of Nearly 3 Million Individuals

A significant cybersecurity incident at the U.S. Department of Defense’s Human Resources database has potentially exposed the sensitive data of millions of military personnel and their affiliates. Unidentified officials confirmed to media outlets that approximately 2.76 million living individuals and 294,000 deceased persons were affected by the breach at the Defense Manpower Data Center (DMDC). The compromised information reportedly includes Social Security numbers, job details, dates of birth, and contact information.

The incident was first brought to light by the Military Times, which cited a breach notification letter sent to an individual whose records were involved. According to the letter, the DMDC discovered a security vulnerability in its file-sharing system on July 16. Between October 2025 and that discovery date, unauthorized users accessed a server containing the personal data. Following the discovery, the center updated its systems to address the vulnerability and stated there is currently no evidence that the recipient’s information has been misused.

The DMDC maintains records for over 60 million people, including active-duty service members, civilians, contractors, family members, retirees, and veterans, based on fiscal year 2024 data. This database is critical for managing healthcare, retirement funding, and other administrative functions for the Defense Department. Experts warn that the duration of the breach and the volume of exposed data create substantial security risks, potentially facilitating further attacks such as phishing campaigns.

This event coincides with a separate investigation by the FBI into alleged cybercriminals linked to the ShinyHunters group, who claim to have stolen sensitive data from the bureau’s jobs website. Additionally, a recent analysis suggested a prior breach may have exposed over 153 million driver’s licenses across the United States and Canada. Security specialists emphasize that breaches involving government databases can have far-reaching consequences beyond simple identity theft.

In response to the DMDC breach, affected personnel have been offered one year of credit monitoring and identity restoration services provided by IDX, a private contractor. The Federal Trade Commission advises that individuals place a free credit freeze with Equifax, Experian, and TransUnion. Active duty military and National Guard members are also eligible for free electronic credit monitoring to help detect potential signs of identity theft.