Hajra Naz
The U.S. government is reportedly alerting millions of current and former military service members. It’s also notifying staff members about something concerning. Their personal information was stolen during a months-long breach. This breach targeted the Pentagon’s personnel records. It’s the latest in a series of thefts involving federal workers’ data in recent months.
A data breach notification came from the Defense Manpower Data Center (DMDC). This notice was shared on Reddit. It explains that several unauthorized users exploited a security vulnerability. This happened within an unspecified file-sharing system. The breach occurred over several months, from October 2025 to mid-July 2026.
The breach exposed significant personally identifiable information. That includes Social Security numbers. It also includes a person’s name, date of birth, sex, race, and details about their military service. According to the notice, these personnel records were stored unencrypted.
According to CNN and Federal News Network, a Pentagon official shared specific numbers. The breach affects about 2.8 million living people. It also affects close to 300,000 deceased individuals.
For context, the U.S. military had 1.3 million active service members as of March.
Read More: 4 Early Warning Signs of a Potential Data Breach
The DMDC may not be widely known to the general public. Still, it serves as one of the Department of Defense’s key records-keeping units. The DMDC maintains more than 60 million records. These cover U.S. military and civilian staff, plus their family members. This data helps determine benefits and entitlements, like healthcare and retirement.
The unit also provides another critical service. It functions as the military’s “leading identity management provider.” This links active service members, employees, and contractors to important credentials. That includes smart cards and passwords. These credentials grant access to Pentagon computer systems, buildings, and bases.
“We make sure that the right people get access and the wrong people don’t: security of identity information is paramount,” the DMDC’s website reads.
The Department of Defense oversees the DMDC. The department said it does not indicate that this information was misused. However, it didn’t explain how it reached that conclusion. A Pentagon spokesperson was contacted about whether officials had any communications from the hackers. The hackers’ identities remain unknown. No response was received.
This represents the latest major breach of federal workers’ personal information in recent months. It follows a recent breach at the FBI earlier in September. That breach was attributed to the ShinyHunters hacking group. The hackers claimed they had stolen personal information from most FBI agents and staffers.
Read More: Over 250 Million Personal Records Exposed in Massive Global Data Breach
This included information about applicants too. That breach has been described as a “counterintelligence disaster.” This label reflects real risks involved. A foreign government could obtain this information. They could use it to profile, target, or coerce federal workers into handing over sensitive information.
The ShinyHunters hackers have said something specific about the stolen FBI data. They will not publicly release this information.
Both breaches, involving the FBI and the DMDC, mirror similar past incidents. These thefts targeted government personnel records before too. In 2015, a breach hit the U.S. government’s human resources department.
That’s known as the Office of Personnel Management. This breach was broadly attributed to China. The theft allowed hackers to steal private records. More than 22 million U.S. government employees were affected. Many of these employees held security clearances at the time.
