Pentagon personnel agency discovered the file-server flaw nine months after intruders began using it
Defense Manpower Data Center is notifying people after intruders read unencrypted files on its server for nine months, exposing 2.76 million living people. Nine months of access means every file that server held over the period should be treated as copied.
The Watch · Security desk
What happened
- A Department of War official told CNN that 294,000 deceased people are also affected, a count that does not appear in DMDC's own letter.
- In the letter one recipient shared, the exposed data included a Social Security number and at least one other identifier, such as name, birth date, contact details, race or military specialty.
- DMDC says the Department of War has no indication so far that the accessed information has been misused.
- DMDC is offering 12 months of free credit monitoring through IDX, with enrollment open until August 19, 2027.
Why it matters
- Who's exposed exposure Whoever holds copies can contact each person directly and build a phishing pretext around their real military job, a risk that sits outside the credit misuse the IDX monitoring is meant to catch.
- What it limits constraint Other agencies and companies running file-sharing servers cannot check for the same flaw until the product or the vulnerability is named.
- What it limits constraint Defense contractors cannot tell from public reporting whether their staff are among the 2.76 million; for now only the individual letters answer that.
Next story · Product · Oct 1
Pentagon breach exposes the job specialties of 2.8 million current and former personnelConfirmed2 publishers
DMDC's letter puts the flaw first and the intruders second. It says a vulnerability in a DMDC file-sharing system was found on July 16, 2026, and that "DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored" [9]. Only after that does it report that "a small number of unauthorized users accessed files on a server containing unencrypted PII," with access going back to October 2025 [5]. Depending on when in October it began, the window ran roughly 8.5 to 9.5 months [17].
Those few users reached a lot of people. Counting the deceased, the figures a Department of War official gave CNN add up to about 3.05 million [16]. That count comes from one unnamed official [2]. CNN reported that the official described the living group as potentially including current and former defense personnel or their dependents [4]. DMDC's holdings are far wider: at least 60 million records as of fiscal 2024, covering military and civilian personnel, contractors, family members, retirees and veterans [15].
The copy of the letter that is now public was posted by a recipient. It is dated September 18 [13], 64 days after the flaw was found [18]. DMDC says it is still assessing the affected system and taking steps to improve its security [12].
The letter does not name the file-sharing product or describe the vulnerability [14]. No known cybercrime group appears to have taken credit, and it is unclear who is behind the attack [10]. On the public record this is one intrusion at one agency, with no named actor or tool that would tie it to a campaign. If the flaw is in a commercial product, that product's other operators had the same opening until a fix reached them.
What to watch
- DMDC or the Department of War naming the file-sharing product or the vulnerability, so other operators can check their own servers.
- A group claiming the intrusion, or DMDC records turning up for sale, would tie this to an actor and end the single-incident read.
- Any change to the Department of War's statement that it has no indication of misuse, or a revised count once DMDC finishes assessing the system.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives35
- Confidence68
Perspective Coverage
9 publishers- Builder
- Builder 13%
- Operator
- Operator 81%
- Investor
- Investor 6%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
DMDC, which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed; according to its notice, unauthorized users had access to one of its file-sharing servers for roughly nine months.
- [2]
A Department of War official told CNN that the breach impacts 2.76 million living individuals.
- [3]
A Department of War official told CNN that the breach impacts 294,000 deceased individuals.
- [4]
CNN reported that the 2.76 million 'living individuals' category potentially includes current and former defense personnel or their dependents.
- [5]
"Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII,"
- [6]
"At this time, DoW does not have any indications of misuse of the accessed information," DMDC says.
- [7]
The types of PII vary by individual; in the recipient's case they include Social Security number and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information such as occupational specialty.
- [8]
The notification letter does not say how many people are affected.
- [9]
"On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored."
- [10]
It is unclear who is behind the cyberattack; no known cybercrime group appears to have taken credit for an attack on the DMDC.
- [11]
DMDC is offering 12 months of free credit monitoring through IDX; the deadline to enroll is August 19, 2027.
- [12]
DMDC launched its privacy and cybersecurity incident response process and says it is assessing the affected system and taking steps to improve its security.
- [13]
A copy of the notification letter, dated September 18 and shared online by a recipient, says the problem was discovered in mid-July.
- [14]
The letter does not name the affected file-sharing product or describe the vulnerability.
- [15]
According to its website, DMDC held at least 60 million records as of fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans.
- [16]
The official's figures total about 3.05 million people.
- [17]
The access window ran roughly 8.5 to 9.5 months, depending on when in October 2025 it began.
- [18]
The letter is dated 64 days after the flaw was discovered.
Sources
7 independent publishers whose own reporting we read for this story.
- abcnews.comPentagon breach exposed sensitive data on nearly 3 million people - ABC News
1 article · September 28, 2026
- bleepingcomputer.comHackers stole Pentagon personnel records of over 3 million people
1 article · October 1, 2026
- helpnetsecurity.comPentagon breach exposes personal data of more than 3 million people
1 article · October 1, 2026
- malwarebytes.comPentagon breach exposes Social Security numbers and military records of millions
1 article · October 1, 2026
- mezha.netЗловмисники викрали дані 2,8 мільйона живих людей і майже 300 тисяч померлих із системи Пентагону
1 article · September 30, 2026
- scworld.comPentagon data breach exposes personal information of millions of service members
1 article · October 1, 2026
- securityaffairs.comThree Million Affected in Pentagon Personnel Agency Data Breach
1 article · September 29, 2026
- securityweek.comPentagon Personnel Agency Data Breach Impacts 3 Million People
1 article · September 29, 2026
- tomshardware.comPentagon gets pwned as breach exposes sensitive data on nearly three million military and civilian personnel
1 article · September 30, 2026
Topics and entities
Entities
- Defense Manpower Data Center
- Pentagon
- ShinyHunters