The Pentagon's Defense Manpower Data Center (DMDC) suffered a data breach starting in October 2025, where attackers exploited a vulnerability in the DMDC's file-sharing systems to access sensitive personnel data. The breach affected over 3 million people, including nearly 2.8 million living and 294,000 deceased individuals. Stolen data includes Social Security numbers, names, dates of birth, contact information, sex, race, and military personnel information. The breach was discovered and contained by July 2026, with DMDC initiating privacy and cybersecurity incident response actions in line with federal guidelines. Affected individuals are being notified and offered credit monitoring services.

The breach exposed highly sensitive personally identifiable information (PII) of over 3 million military personnel, including Social Security numbers and other personal and military data. This exposure increases the risk of identity theft, fraud, and potential targeting of affected individuals. The compromise of deceased individuals' data also raises privacy concerns. The breach undermines trust in the security of Pentagon personnel systems and may have broader implications for national security personnel privacy.

The DMDC has initiated privacy and cybersecurity incident response actions following the discovery of the breach. Affected individuals are being notified and offered 12 months of free credit monitoring through IDX. Organizations and individuals should follow official guidance from the DMDC and enroll in the offered credit monitoring service by the specified deadline. No additional remediation steps are publicly detailed; the DMDC is assessing and enhancing its cybersecurity posture.