Pentagon personnel system breach exposes data of over three million people
Unauthorized access to Defense Manpower Data Center records follows separate security incident at FBI recruitment site
Quick Look
- A security vulnerability in the Pentagon's Defense Manpower Data Center exposed sensitive personal information, including Social Security numbers, of approximately 3 million military-affiliated individuals.
- The breach occurred between October 2025 and July 2026.
AI-generated summary
Why It Matters
The DMDC manages records for over 60 million individuals, including active-duty troops, veterans, and civilian contractors. The FBI is simultaneously investigating a separate breach claim by the group ShinyHunters.
A Pentagon personnel system breach has reportedly exposed sensitive data on more than three million people, including military personnel and their families, several media outlets have reported, citing US defense officials. The disclosure follows a separate breach of the FBI’s jobs website.
The Defense Manpower Data Center (DMDC) system was reportedly accessed by a small number of unauthorized users between October 2025 and July 2026, affecting some 2.76 million living people and another 294,000 who are deceased, unidentified Pentagon officials have told CNN and ABC News.
According to them, the exposed files include Social Security numbers and other personal details, as well as information about military jobs and occupational specialties.
DMDC maintains more than 60 million records overall, including on active-duty and reserve troops, civilian employees, contractors, retirees, veterans, and military family members.
The leak was initially reported by the Military Times last week citing an internal breach notice received by one of the affected individuals. The publication said two unnamed defense officials had confirmed the authenticity of the letter.
According to the notice, DMDC said that a “security vulnerability” in a file-sharing system allowed unauthorized users to gain access to unencrypted personal information. The system was said to have been patched “immediately” after it was discovered – nearly nine months after the unauthorized access began.
The notice offered affected individuals a year of free credit monitoring services.
However, the Pentagon has not yet officially confirmed the breach, nor commented on who was behind the intrusion or what they did with the information they accessed.
Meanwhile, the FBI is dealing with an unrelated breach claim involving its recruitment website. Last week, the hacking group ShinyHunters claimed it had stolen personal data on nearly all FBI agents, their spouses, and job applicants.
The group said that the attack was “not financially motivated” and instead of a ransom, demanded that the FBI remove a cybersecurity advisory published in May that ShinyHunters says contains false allegations about them.
The FBI has said it is investigating and has notified employees, but has not yet established where the breach occurred or confirmed the scale of the theft.
What to Watch
AI outlook — possibilities, not facts
Pentagon to conduct formal investigation into the DMDC security vulnerability.
Likely · Within months
Open Questions
- Who was responsible for the Pentagon system breach?
- What was the intent behind the unauthorized access?
- Has the FBI confirmed the scale of its own data theft?
