Washington: A breach of the Pentagon's personnel records system went undetected for roughly nine months, exposing the personal information of about 3 million current and former US military personnel and others, according to a federal notification letter obtained by Nextgov/FCW.
The breach hit the Defense Manpower Data Center (DMDC), which maintains personnel information used across the US military and other government agencies. Unauthorized access ran from October 2025 until July 16, 2026, when DMDC discovered a vulnerability in a file-sharing system that had been exploited.
What was exposed
According to the breach notification letter signed by DMDC Director Katie Griffin, the compromised files contained unencrypted personal information including Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties.
On scope, Nextgov/FCW reported the breach "affected roughly 3 million people." A defence official separately told CNN the breach touched 2.76 million living people and another 294,000 deceased individuals — about 3.05 million in total. The two figures have not been reconciled by the Pentagon.
Response and scrutiny
The Pentagon said the flaw has been patched and the system restored, and affected individuals are being offered a year of credit monitoring and identity-restoration services.
The disclosure, first reported by Military Times late last month, is drawing fresh scrutiny of federal cybersecurity standards because of how long the intrusion went unnoticed. "Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning," Nitay Milner, co-founder and CEO of ORION Security, told Nextgov/FCW. Jeff Wichman of Semperis added that even well-resourced organisations keep getting hit.
The disclosure comes as the FBI responds to a separate breach claim by the group ShinyHunters involving personnel records of people in intelligence-gathering roles; Nextgov/FCW reported there is no public evidence linking the two intrusions.
Sources:
Nextgov/FCW: Pentagon personnel breach — undetected for months — renews cyber standard scrutiny
The breach hit the Defense Manpower Data Center (DMDC), which maintains personnel information used across the US military and other government agencies. Unauthorized access ran from October 2025 until July 16, 2026, when DMDC discovered a vulnerability in a file-sharing system that had been exploited.
What was exposed
According to the breach notification letter signed by DMDC Director Katie Griffin, the compromised files contained unencrypted personal information including Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties.
On scope, Nextgov/FCW reported the breach "affected roughly 3 million people." A defence official separately told CNN the breach touched 2.76 million living people and another 294,000 deceased individuals — about 3.05 million in total. The two figures have not been reconciled by the Pentagon.
Response and scrutiny
The Pentagon said the flaw has been patched and the system restored, and affected individuals are being offered a year of credit monitoring and identity-restoration services.
The disclosure, first reported by Military Times late last month, is drawing fresh scrutiny of federal cybersecurity standards because of how long the intrusion went unnoticed. "Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning," Nitay Milner, co-founder and CEO of ORION Security, told Nextgov/FCW. Jeff Wichman of Semperis added that even well-resourced organisations keep getting hit.
The disclosure comes as the FBI responds to a separate breach claim by the group ShinyHunters involving personnel records of people in intelligence-gathering roles; Nextgov/FCW reported there is no public evidence linking the two intrusions.
Sources:
Nextgov/FCW: Pentagon personnel breach — undetected for months — renews cyber standard scrutiny
