The Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, has notified 3.054 million individuals that their personal information was exposed in a data breach. The breach, which impacted 2.76 million living individuals and 294,000 deceased individuals, occurred over an approximately nine-month period between October 2025 and July 16, 2026. The vulnerability in the file-sharing system was discovered on July 16, and the agency immediately patched the system and restored it.
An investigation determined that unauthorized users accessed files containing unencrypted personally identifiable information (PII). The exposed data varies by individual but includes Social Security numbers (SSNs) and at least one additional identifier such as name, date of birth, contact information, sex, race, or military personnel information including occupational specialty.
After discovery, DMDC launched its privacy and cybersecurity incident response process in accordance with U.S. government policies and guidelines. The agency is assessing the affected system and implementing security improvements. DMDC is offering 12 months of free credit monitoring through IDX, a data breach and recovery services company.
Affected individuals are encouraged to enroll via the dedicated IDX website using the enrollment code provided in the breach notification letter. The enrollment deadline is August 19, 2027.
As of the notification, no cybercrime group has claimed responsibility for the attack. The breach disclosure aligns with the timeline of the vulnerability being present from October 2025 to July 16, 2026, with discovery and patching occurring on the latter date. The DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees, and veterans.
Sources
Background and why it matters
The Pentagon Personnel Agency, known as the Defense Manpower Data Center (DMDC), is a critical entity within the United States Department of Defense. Its primary role is to maintain personnel records for the Department, encompassing military and civilian personnel, contractors, family members, retirees, and veterans.
The DMDC’s history dates back to the 1960s, when it was established as a response to the growing complexity of managing personnel records within the Department of Defense. Over the years, it has amassed a vast database, holding at least 60 million records in fiscal year 2024 alone.
The recent data breach affecting 3.054 million individuals, including both living and deceased individuals, highlights the sensitive nature of the information stored by the DMDC. The breach, which occurred over an approximately nine-month period between October 2025 and July 16, 2026, underscores the vulnerabilities that can exist in even well-established systems.
The exposed data includes Social Security numbers, names, dates of birth, contact information, sex, race, and military personnel information, making it a significant concern for those affected. The breach disclosure aligns with the timeline of the vulnerability being present from October 2025 to July 16, 2026, with discovery and patching occurring on the latter date.
The breach serves as a reminder of the importance of robust cybersecurity measures in protecting sensitive personal information. As the DMDC continues its investigation and implements security improvements, it is offering 12 months of free credit monitoring to those affected. Affected individuals are encouraged to enroll via the dedicated IDX website using the enrollment code provided in the breach notification letter.
At present, no cybercrime group has claimed responsibility for the attack, but the incident underscores the need for ongoing vigilance and proactive measures to safeguard sensitive personal information in the digital age.
