Unencrypted Pentagon Personnel Files Exposed in Nine-Month Server Breach

More than three million living and deceased people are affected

The U.S. Defense Manpower Data Center is notifying individuals after unauthorized users accessed unencrypted personal information stored on one of its file-sharing servers.

DMDC maintains personnel records for the Department of Defense. An official identified in reporting as a Department of War official told CNN that the incident affects 2.76 million living individuals and 294,000 deceased individuals. Together, those figures place the affected population at just over three million.

The intrusion potentially reaches well beyond active-duty service members. DMDC’s wider record holdings cover military and civilian personnel, contractors, family members, retirees, and veterans. The center held at least 60 million records in fiscal year 2024, although that number represents its overall data volume rather than the population exposed in this breach.

The agency discovered a vulnerability in the file-sharing system on July 16, 2026. Its investigation found that a small number of unauthorized users had accessed files from October 2025 until the flaw was detected, creating an exposure window of roughly nine months.

A notification letter was dated September 18, but the year associated with that date was not specified in the available reporting.

Social Security numbers and personnel details were accessible

The information involved differs from person to person. Exposed files could include:

• Social Security numbers;
• Names;
• Dates of birth;
• Contact information;
• Demographic data, including sex and race;
• Military occupational specialties; and
• Other identifying or personal information held by DMDC.

Not every affected individual necessarily had every listed field exposed. DMDC has not published a record-by-record breakdown showing how many files contained Social Security numbers or particular categories of military information.

The presence of SSNs raises the long-term risk associated with the incident. Unlike a password or payment card, a Social Security number cannot usually be replaced quickly after exposure. Names, birth dates and contact details can also make fraudulent communications more convincing when combined with data obtained elsewhere.

Military occupational specialties add another layer of sensitivity. The available notices do not say whether the compromised files included deployment details, security-clearance information, unit assignments or operational records. Those data types should not be assumed to have been exposed.

It is also unclear how many records were associated with each affected person. An individual may appear in multiple administrative files, so the number of accessed documents cannot be inferred from the reported population.

The vulnerable product and exploitation method remain undisclosed

DMDC has provided little technical information about the weakness. The agency has not identified the file-sharing product, its affected versions, the component containing the vulnerability or the configuration in use when the intrusion occurred.

No CVE identifier, severity score or exploitation method has been released. Consequently, it is not possible to determine whether the attackers used an authentication bypass, a remote-code-execution flaw, stolen credentials, a misconfiguration or another route into the server.

The description of unencrypted PII establishes that the information was readable in the files. It does not reveal whether the server’s disks, network connections or backups used other forms of encryption.

DMDC also has not disclosed how the unauthorized activity was detected, whether the users downloaded the files, or how frequently they returned during the nine-month period. No IP addresses, file hashes, account names, malware samples or other indicators of compromise have been made public.

Because the product and vulnerability remain unidentified, there is no basis for matching the incident to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. No KEV inclusion date or federal remediation deadline has been reported.

This lack of detail also prevents organizations operating similar file-sharing infrastructure from checking whether they run the same vulnerable software. At present, the actionable technical guidance is limited to DMDC’s own environment.

The attackers have not been identified

No person, criminal organization or state-linked group has been publicly attributed with the intrusion. There has also been no reported claim of responsibility.

DMDC said it had found no indication that the accessed information had been misused when it issued its notice, according to reporting on the incident and notification. That finding is narrower than proof that no copies were made or that misuse will not occur later.

The known facts establish unauthorized access to files containing PII. They do not establish whether the objective was identity theft, intelligence collection, financial fraud or indiscriminate data harvesting.

The inclusion of 294,000 deceased individuals also complicates monitoring. The available information does not explain which records concerning those individuals were accessed or whether related family and contact information appeared in the same files.

DMDC patched and restored the file-sharing system

After discovering the vulnerability, DMDC initiated privacy and cybersecurity incident-response procedures. The agency says it promptly updated the affected system to correct the flaw and then restored the service.

DMDC is also assessing the system and taking measures to improve its security, according to the account published on September 29, 2026. No further details about those improvements have been disclosed.

The agency has not said whether the response included forced credential resets, broader network hunting, third-party forensic support or a review of other systems running the same software. It has likewise not released findings about lateral movement beyond the affected server.

Patching closes the identified vulnerability, but it does not reverse access that already occurred. The remaining questions concern what the unauthorized users viewed or retained and whether the available logs can support a complete reconstruction of their activity.

Affected people can obtain 12 months of credit monitoring

DMDC is offering affected individuals 12 months of free credit monitoring through IDX, a breach-response and identity-recovery services provider. Enrollment uses a dedicated IDX website and the code supplied in the individual notification.

The reported enrollment deadline is August 19, 2027. Recipients with questions are being directed to contact IDX.

Anyone receiving a notice should confirm that the enrollment address and code came through the official notification before submitting personal information. Large breaches routinely create opportunities for phishing messages that imitate credit-monitoring offers.

Affected individuals should review credit reports and financial accounts for unfamiliar activity. A credit freeze can limit the opening of new accounts, while account alerts may help identify suspicious transactions quickly. These precautions address identity-related fraud, but they cannot prevent every possible use of exposed demographic or military personnel information.

Recipients should also be cautious about calls or messages that reference authentic personal details to establish credibility. Knowledge of a birth date, occupational specialty or partial personnel history does not prove that a caller represents DMDC, the Department of Defense or IDX.

For now, the incident’s scale is clear, but its technical cause and ultimate consequences are not. More complete disclosure would be needed to establish how the server was breached, how much information was copied and whether the same vulnerability threatens other systems.