Pentagon Alerts Millions of Military Personnel to Data Breach Exposing Personal Information

The United States government is reportedly notifying millions of current and former U.S. military service members and staff that their sensitive personal information was compromised and stolen during a prolonged security breach targeting the Pentagon’s extensive personnel records. This incident marks the latest in a troubling series of data thefts impacting federal workers’ data in recent months, raising significant concerns about national security and individual privacy.

The breach, which lasted for several months between October 2025 and mid-July 2026, was confirmed through a data breach notification issued by the Defense Manpower Data Center (DMDC). A copy of this notification, shared publicly on Reddit, indicates that multiple unauthorized users successfully exploited a security vulnerability within an unspecified file-sharing system used by the DMDC. The extended duration of the breach allowed the attackers ample time to exfiltrate a significant volume of highly sensitive data.

The compromised information includes personally identifiable information (PII) that could be used for identity theft, fraud, or targeted exploitation. Among the critical data points exposed were individuals’ Social Security numbers, a cornerstone of personal identity in the U.S. In addition to Social Security numbers, the breach revealed full names, dates of birth, sex, race, and other detailed information pertaining to individuals’ military service. A particularly concerning aspect highlighted in the notification is that these personnel records were stored and accessed in an unencrypted format, significantly increasing the risk associated with their exposure. Unencrypted data, once accessed, is immediately readable and usable by unauthorized parties, unlike encrypted data which would require further decryption efforts.

According to reports from CNN and Federal News Network, a Pentagon official confirmed the vast scale of the breach. The official stated that approximately 2.8 million living individuals have been affected by the incident. Furthermore, the breach regrettably extended to close to 300,000 individuals who are deceased, meaning their historical records were also compromised. To put this into perspective, the U.S. military currently comprises 1.3 million active service members as of March, indicating that the breach impacts a demographic far broader than just current personnel, encompassing veterans and former staff.

While the Defense Manpower Data Center (DMDC) may not be a widely recognized entity among the general public, it serves as one of the Department of Defense’s most crucial and extensive records-keeping units. The DMDC plays an indispensable role in maintaining over 60 million records, covering U.S. military personnel, civilian staff, and their family members. This vast database is fundamental to determining eligibility for various benefits and entitlements, including vital healthcare services and retirement packages. Beyond its record-keeping function, the DMDC is also lauded as the military’s "leading identity management provider." In this capacity, it is responsible for linking active service members, employees, and contractors to essential credentials, such as smart cards and passwords. These credentials are the primary means by which authorized individuals gain access to secure Pentagon computer systems, restricted buildings, and military bases, making the integrity of DMDC’s identity management systems paramount to national security.

The gravity of the DMDC’s mission is underscored by its own public statement on its website, which reads: "We make sure that the right people get access and the wrong people don’t: security of identity information is paramount." This declaration highlights the inherent contradiction between the DMDC’s stated commitment to security and the reality of this months-long breach, underscoring the severe implications of the compromised data.

The Department of Defense, which exercises oversight over the DMDC, has publicly stated that it has no indication that the stolen information has been misused following the breach. However, the department did not provide any explanation or evidence to substantiate how it reached this conclusion, leaving questions unanswered regarding the scope of their investigation into potential misuse. TechCrunch, the original source of this report, attempted to contact a Pentagon spokesperson to inquire whether officials had received any communications from the unknown hackers responsible for the breach. As of the time of publication, no response was received, further obscuring details about the perpetrators and their motives.

This breach involving the Pentagon’s personnel records is not an isolated incident but rather the latest in a series of major compromises affecting federal workers’ personal information in recent months. Earlier in September, the Federal Bureau of Investigation (FBI) also declared a significant cybersecurity incident after hackers reportedly stole sensitive personal data belonging to its agents. That breach was attributed to the notorious ShinyHunters hacking group, which claimed to have acquired the personal information of the majority of FBI agents, staffers, and even applicants. The FBI breach has been widely characterized as a "counterintelligence disaster," largely due to the profound risks it poses. Experts fear that foreign governments or hostile entities could obtain and leverage this stolen information to profile, target, or coerce federal workers into divulging classified or sensitive information, thereby undermining national security. While the ShinyHunters hackers have stated they will not publicly release the stolen FBI data, the mere possession of such information by an unauthorized group remains a critical threat.

Both the recent breaches involving the FBI and the DMDC bear striking resemblances to past thefts of government personnel records, highlighting a persistent vulnerability within federal systems. A prominent historical precedent is the devastating 2015 breach of the U.S. government’s human resources department, then known as the Office of Personnel Management (OPM). That massive cyberattack was broadly attributed to state-sponsored actors from China. The OPM theft resulted in the compromise of private records belonging to more than 22 million U.S. government employees, many of whom held high-level security clearances. The long-term ramifications of such extensive data loss, particularly concerning individuals with access to classified information, continue to be a subject of national security concern. The recurring nature of these breaches underscores an ongoing challenge for federal agencies in safeguarding the highly sensitive personal and professional data of those who serve the nation.

Did you receive a notice about this data breach? We want to hear from you. You can contact this reporter securely on Signal at zackwhittaker.1337, or reach him by email at [email protected].

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security. He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected].