The Pentagon is notifying people after attackers stole sensitive personnel information from its human resources management system. The Pentagon data breach affects more than 3 million individuals, including nearly 2.8 million living people and approximately 294,000 deceased individuals.
According to notification letters from the Defense Manpower Data Center, unauthorized users accessed sensitive information between October 2025 and July 2026. The attackers gained access by exploiting a vulnerability in its file-sharing systems.
Stolen Information Includes Social Security Numbers
The compromised information varies between individuals. It includes names, Social Security numbers, dates of birth, contact details, sex, race and military personnel information.
DMDC described the intruders as a small number of unauthorized users. However, the notification does not identify them or explain how they used the stolen records.
The access period extended across roughly nine months. Nevertheless, the available information does not establish the exact discovery date or whether attackers maintained continuous access throughout that period.
DMDC Begins Notifications and Security Response
DMDC says it initiated privacy and cybersecurity incident response procedures immediately after discovering the vulnerability. Those actions followed federal and departmental requirements.
The center also says it is assessing and strengthening the affected system’s security. However, the available account does not identify the vulnerable file-sharing product or provide detailed remediation information.
The Pentagon data breach concerns a system that holds sensitive information for personnel administration. As a result, the exposure extends beyond basic contact records to identifiers and military-related details.
Affected Individuals Receive Credit Monitoring Offer
The Pentagon is offering affected individuals 12 months of free credit monitoring through IDX, a breach response and recovery provider.
According to the notification, recipients must enroll by August 19, 2027.
The offer accompanies the breach notices. However, the information provided does not establish whether anyone has used the stolen records for identity theft or fraud.
Personnel Center Holds More Than 60 Million Records
Founded in 1974, DMDC supports the Department of Defense through personnel records, benefits administration and related services.
Its holdings include more than 60 million records covering military members, civilian employees, contractors, family members, retirees and veterans. It also maintains information supporting training, financial functions and other departmental needs.
That broader database figure does not represent the confirmed breach total. Instead, Pentagon officials put the affected population at more than 3 million people.
Meanwhile, key questions remain about the intrusion, including the attackers’ identities and the full circumstances of the file-sharing vulnerability.
0 responses to “Pentagon Data Breach Exposes Personnel Records of Over 3 Million People”