Breach at Pentagon personnel database exposed data of millions

A security vulnerability at the Pentagon’s massive personnel records repository exposed the sensitive data of millions of U.S. troops and civilian employees to unauthorized users, according to multiple media reports.

The breach of a Defense Manpower Data Center file-sharing system occurred sometime between October 2025 and July 16, 2026, when the vulnerability was discovered, Military Times first reported last week.

The intrusion exposed the unencrypted information of 2.76 million living people and another 294,000 who are deceased, ABC News reported Tuesday, citing an unnamed U.S. defense official.

Pentagon officials did not immediately respond to a request from Stars and Stripes seeking more information on who may have accessed the files.

The breach raises national security concerns due to the sensitivity of the data, which included Social Security numbers and military job details.

A letter from Sept. 18 informing those whose data was affected was uploaded last week to the Reddit forum r/AirForce. It appears to match the information in the Military Times report, which was authenticated by two defense officials.

According to the letter and the Times report, the breach was discovered July 16 and was immediately patched. A follow-up investigation found that a “small number of unauthorized users” had accessed a server containing unencrypted files with personally identifiable information, known in defense circles as PII, the letter states.

The information included Social Security numbers, as well as at least one additional piece of information, such as names, dates of birth, contact information, sex, race and military job information, the letter said.

The data center is the central repository for more than 60 million individual records from military, civilian, contractor, family members, retirees and veterans. The data includes personnel, manpower, training and financial records.

According to the letter, the Pentagon has not detected any instances of the data being misused. A link included in the letter directs users to a Pentagon site offering a year of free credit monitoring protection.

“Upon discovery of the security vulnerability, DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of Management and Budget and Department guidelines and policies,” the letter said. “We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system.”