Pentagon DMDC breach exposes data on 3 million people

The Defense Manpower Data Center (DMDC) — the Pentagon office that keeps personnel records for service members, civilians, and dependents — is notifying more than 3 million people that unauthorized users sat on one of its file-sharing servers for roughly nine months. The exposed records were unencrypted, and no group has claimed the intrusion.

What's affected

Per the DMDC's breach notification, reported by BleepingComputer and SecurityWeek, the stolen data includes names, dates of birth, sex, race, Social Security numbers, and military service information. The notice counts roughly 2.76 million living individuals and about 294,000 deceased.

The intrusion did not hit a classified system — it hit an HR records store. But SSNs plus service history is a full identity-theft kit, and the data was not encrypted at rest.

Timeline

• October 2025 — unauthorized access to the file-sharing server begins, per DMDC.
• July 16, 2026 — DMDC discovers the activity.
• ~9 months — the window attackers retained access before detection.

DMDC says it "immediately initiated privacy and cybersecurity incident response actions" and patched the file-sharing system once the vulnerability was found. The specific product and CVE have not been disclosed; this post is based on the agency's notification and the two outlets above, not a vendor advisory.

Attribution

Unattributed. Federal News Network reports the agency described the intruders only as a small number of unauthorized users. No known cybercrime group has taken credit. We won't name an actor that nobody has named.

What to do today

1. If you're a current or former DoD affiliate, assume your SSN is in this set and enroll in the offered IDX credit monitoring — the notice sets an enrollment deadline of August 19, 2027.
2. Freeze your credit at all three bureaus now rather than relying on monitoring alone; a freeze blocks new-account fraud, monitoring only reports it.
3. Watch for targeted phishing and benefits-fraud lures. A nine-month window on HR data is enough to build convincing, personalized pretexts.
4. If you run a file-sharing appliance, treat this as a prompt to review who can reach it and whether its contents are encrypted at rest — the unencrypted store is what turned an intrusion into mass exposure.

Context

The detail that matters isn't the breach, it's the nine months: a long dwell time on a records server holding SSNs for millions, discovered internally rather than flagged by a monitoring control. The unencrypted-at-rest decision is the force multiplier — it is the difference between "attacker touched a server" and "attacker walked off with 3 million identities." For an agency that sets security policy for the rest of the executive branch, encryption-at-rest on a personnel datastore is not an advanced ask.