Pentagon Data Breach Exposes 2.8 Million Military Personnel Records

Summary

Several unauthorized users exploited a vulnerability in an unspecified file-sharing system from October 2025 to mid-July 2026, stealing unencrypted Defense Manpower Data Center records. The breach affects about 2.8 million living people and close to 300,000 deceased people, exposing names, Social Security numbers, birth dates, sex, race and military service information. The U.S. military had 1.3 million active members as of March. The Department of Defense says it has no indication of misuse but has not explained that assessment. The attackers remain unidentified, and the Pentagon has not disclosed whether they contacted officials.

DMDC maintains more than 60 million records for military and civilian personnel and their families, determining healthcare and retirement entitlements while linking service members, employees and contractors to smart cards and passwords used for Pentagon systems, buildings and bases. The breach follows a September FBI intrusion attributed to ShinyHunters, which claimed it stole data on most agents, staff and applicants but said it would not publish it. That theft raised concerns foreign governments could profile, target or coerce federal workers. In 2015, hackers widely linked to China stole records on more than 22 million government employees, many holding security clearances, from the Office of Personnel Management.