The Pentagon is facing new scrutiny over the security of its personnel records after a breach exposed sensitive information belonging to nearly 3 million people, including military and civilian personnel.
The latest incident involved the Defense Manpower Data Center (DMDC), one of the Pentagon’s main repositories for personnel information. According to a US defense official, the breach affected 2.76 million living people and 294,000 deceased people.
The unauthorised access took place between October 2025 and July 2026. DMDC discovered the vulnerability on July 16 and said it immediately patched the affected system.
The exposed information included Social Security numbers and other personal identifiers. Records also contained information about the jobs performed by some military and civilian personnel. This has raised concerns beyond identity theft because details about a person’s military occupation can potentially provide useful information to someone trying to identify or target personnel.
What happened in the latest breach
DMDC maintains more than 60 million personnel records covering active-duty and reserve service members, civilian employees, contractors, retirees, veterans and military family members.
According to breach notifications, unauthorised users exploited a vulnerability in a file-sharing system. The access continued for several months before the vulnerability was discovered. According to the information released so far, unauthorised access began in October 2025 and continued until July 2026. DMDC discovered the vulnerability on July 16 and subsequently patched the affected system.
The Pentagon has not provided a detailed public explanation of how the attackers gained access, how frequently the system was accessed or whether information was actually downloaded.
The timing of the notification has also drawn attention. Affected individuals began receiving notifications in September, roughly two months after the vulnerability was discovered. The department has said there is currently no evidence that the exposed information has been misused.
The FBI breach adds to the concern
The DMDC incident emerged around the same time as a separate breach involving FBIJobs.gov, the FBI’s employment application website.
The FBI warned employees about the incident after an alleged threat actor claimed to have obtained information including names, addresses, contact details, Social Security numbers, dates of birth and emergency contact information.
The FBI has said the affected system was unclassified. The bureau has also begun notifying affected employees and advised them to remain alert to suspicious calls and other attempts to use their personal information.
A hacking group known as ShinyHunters later claimed it would not release the information publicly. ABC News said it had not independently verified the group’s claims. The FBI incident and the Pentagon breach are separate cases. They nevertheless highlight the continuing exposure of personnel information held by US government agencies.
The biggest questions remain unanswered
The Pentagon has not identified who was behind the DMDC breach or explained what their motive may have been. It is also not clear whether the attackers copied, transferred or sold any of the exposed information.
There is currently no public evidence establishing that a foreign government was responsible. There is also no evidence that the exposed information has been misused.
The investigation could provide more information about how the attackers entered the system, what files they accessed and whether additional systems were exposed.
Congressional scrutiny could also focus on how sensitive personnel information was protected, the security of file-sharing systems and the time taken to detect the vulnerability.
A recurring weakness in government cybersecurity
The latest Pentagon breach is smaller than the 2015 OPM incident. Its significance comes from the type of information involved and the role of the organisation that held it.
The repeated targeting of government personnel databases shows why personal information can be a valuable intelligence and criminal asset. Attackers do not necessarily need access to classified military plans to obtain information that could be useful.
Names, contact details, employment records, occupational information and identifiers can be combined with information from other sources to build detailed profiles of government personnel.
For the people affected by the latest breach, the immediate concern is personal security. For the Pentagon, the incident raises a wider question about whether systems holding millions of personnel records are being protected and monitored closely enough.
The investigation into the DMDC breach will determine how much information was actually accessed and whether the incident was limited to the exposed records. Until those questions are answered, the full security implications of the breach remain unclear.