A compromise at the US Defense Manpower Data Center has exposed personal information associated with more than three million people, placing one of the Pentagon’s central personnel repositories under scrutiny. Defense officials say the affected population includes roughly 2.76 million living individuals and about 294,000 deceased people.

The incident was linked to a vulnerability in a file-sharing system connected to DMDC. A small number of unauthorized users were able to reach files on an affected server from October 2025 until July 2026. The agency discovered the weakness on July 16, patched it, restored the system and began its privacy and cybersecurity response.

Unencrypted identity data raises the stakes

The exposed files contained personally identifiable information in unencrypted form. The exact fields vary by person, but the records may include names, Social Security numbers, birth dates, contact information, sex and race. Some files also contained military details such as occupational specialties.

That combination is more dangerous than a single leaked identifier. Criminals can join biographical details with information from public records, social media, data brokers or earlier breaches to create persuasive impersonation attempts. Social Security numbers and dates of birth can support fraudulent credit applications, account recovery abuse and benefits fraud long after the initial disclosure.

Military employment data introduces another concern. Information about roles and affiliations could help an intelligence service or criminal group identify people in sensitive positions, map relationships or design targeted approaches. The Pentagon has not publicly identified the intruders or stated whether the incident was motivated by espionage, financial gain or another objective.

Nine-month access window complicates the investigation

DMDC is a foundational identity and personnel service for the defense community. Its broader holdings cover active-duty and reserve personnel, civilian staff, contractors, retirees, veterans and family members. The organization maintains more than 60 million records overall, although officials have not suggested that the entire repository was exposed.

The reported access period of about nine months leaves investigators with difficult questions. They must determine which files were opened or copied, whether credentials were taken, and whether the same users reached any connected systems. A long dwell time also gives an attacker opportunities to change methods or stage data gradually, making reconstruction harder.

Officials say they have not found evidence that the exposed information has been misused. That is reassuring but cannot eliminate future risk. Stolen identity data can remain valuable for years, and abuse may occur outside systems monitored by the Defense Department.

What affected people should do

Notifications began arriving through a breach letter dated September 18. The department is offering one year of credit monitoring and identity-restoration support through IDX. Recipients should enroll promptly and keep a copy of the notice because it documents their inclusion in the event.

• Review credit reports and place a fraud alert or credit freeze where appropriate.
• Watch bank, credit, tax and government-benefit accounts for unfamiliar activity.
• Use unique passwords and multifactor authentication on email and financial accounts.
• Treat unexpected messages mentioning military service or employment as potential phishing.

Lessons for high-value government systems

Patching the original file-sharing flaw closes the known entry point, but recovery should go further. Sensitive repositories need encryption at rest, tightly scoped access, detailed file-audit logs and alerts for unusual downloads. Data-minimization policies can also reduce the amount of material available when a server is compromised.

The incident demonstrates why external file exchange deserves the same defensive attention as core identity platforms. Systems built to move information between organizations can become a bridge to high-value records if segmentation and authorization are weak.

DMDC says it is strengthening the affected environment while the investigation continues. For the people involved, the priority is long-term vigilance. For the Pentagon, the central tasks are establishing what the intruders obtained, explaining why the files were not encrypted and demonstrating that related access paths have been closed.

Source: Cyber Security News reporting on the Defense Manpower Data Center incident.