Hackers Stole Pentagon Personnel Records of Over 3 Million People
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of current and former military personnel that hackers stole their personal data after breaching its human resources management system in October 2025.
What was stolen
The incident exposed the unencrypted names, contact information, dates of birth, Social Security numbers, military jobs and other records of nearly 2.8 million living individuals and 294,000 who are deceased, with the type of data exposed varying by person. In total, the breach affects more than 3 million people.
How it happened
Hackers exploited a vulnerability in DMDC's file-sharing systems. A "small number of unauthorized users" had access to the data for nearly a year, from October 2025 to July 2026, and a notice sent to one affected person said the security vulnerability was discovered July 16 and was immediately patched. There's no indication that anyone's personal information has been misused, the Pentagon official said.
Who was hit
The Defense Manpower Data Center serves as one of the Pentagon's main repositories for personnel records, holding information on active-duty and reserve troops, civilian employees, contractors, retirees, veterans and military family members, and maintains more than 60 million personnel records. ABC News reported that the job information could raise national security concerns because the records included details about work performed by military and civilian personnel.
What happens now
IDX, a data breach and recovery services company, will provide 12 months of credit monitoring for those affected. The official declined to answer several questions about the incident, including who accessed the data, whether those affected belong to a particular group, whether the breach was intentional or why personal information is stored on an unencrypted server.
The breach comes just days after a separate incident in which the extortion gang ShinyHunters claimed to have stolen data from the FBI's jobs site after exploiting an Oracle PeopleSoft zero-day. There's also no indication that this incident is related to the hack at the FBI.