A breach of the Defense Manpower Data Center ran undetected for nine months, exposing personal records of current and former military-connected people and their families.
The Pentagon has confirmed a breach of the Defense Manpower Data Center (DMDC), the system that maintains identity records for more than 60 million military personnel, veterans, civilian employees, contractors and family members. The intrusion exposed personal data on nearly 3 million people.
What happened
According to the department and multiple outlets that first reported the incident, the breach began in October 2025 and went undetected for about nine months before it was discovered on July 16, 2026. The Pentagon disclosed the breach publicly in the days around Sept. 24-28, 2026.
A Pentagon official said DMDC "immediately initiated privacy and cybersecurity incident response actions in accordance with Office of Management and Budget at department guidelines and policies." Officials have said there is currently no indication the exposed information has been misused.
What was exposed
The breach affected roughly 2.76 million living individuals and 294,000 deceased people. Exposed data varied by individual but included, according to the Pentagon's notice and reporting from Federal News Network and Time:
- Full names and dates of birth
- Social Security numbers
- Contact information
- Military job specialties and other service records
What affected people should do
The department has contracted with the identity-protection firm IDX to offer affected individuals 12 months of complimentary credit monitoring and identity-restoration services. Active-duty and National Guard members can also access free electronic credit monitoring through existing military benefits.
Steps to take
Enroll in the free IDX credit monitoring offered in the DMDC notice. Consider placing a free credit freeze with Equifax, Experian and TransUnion through the FTC's identitytheft.gov. Watch for phishing attempts that reference the breach.
People who believe they may be affected but haven't received a notice can watch for official communication from DMDC or their service branch; the department has said notifications are continuing to go out as the review proceeds.
Why you can trust this article
Written and edited in-house by the THRYV Tech Desk. We do not republish or reword agency copy, and we do not invent quotes, statistics, testimonials or ratings. Where figures move frequently, we point you to the primary release rather than printing a number that will be out of date. Advertising and affiliate partnerships have no influence on our reporting — see our editorial standards, fact-checking policy and affiliate disclosure. Spotted an error? Write to newsroom@thryv-news.com.
General information only. Not personalised financial, medical or legal advice.
