Pentagon confirms massive data breach affecting 2.76 million people

The Pentagon has confirmed a significant cybersecurity breach affecting the Defense Manpower Data Center (DMDC), one of its primary repositories for personnel records. According to a US defence official, the system experienced unauthorized access between October 2025 and July 2026.

The breach exposed personally identifiable information for approximately 2.76 million living people and around 294,000 deceased individuals. The DMDC holds records on active-duty and reserve military personnel, civilian employees, contractors, and military veterans. Affected data included Social Security numbers and details about military and civilian job positions.

The stolen data was not encrypted, potentially making it easier for unauthorized parties to cross-reference information with other leaked databases. Defence officials stated they have found no evidence so far that the exposed information was misused, and no hacking group has publicly claimed responsibility for the breach.

The scope of the breach amounts to roughly one in twenty of the DMDC's total records, which hold information on more than 60 million people. Military occupational specialty information was also accessed, which when combined with Social Security numbers could potentially assist foreign adversaries in understanding US military deployment and operations. Once unauthorized access was discovered, the DMDC immediately remediated the vulnerability.