Pentagon Says DMDC Breach Exposed 2.76 Million Living People for Nine Months

The Pentagon has disclosed that a flaw in a Defense Manpower Data Center file-sharing system exposed the personal records of about 2.76 million living people, along with roughly 294,000 deceased individuals, and that unauthorized users had access to the files for close to nine months before anyone detected it.

Related reading: Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records · Capcom Says a Breach Exposed 11.7 Million CAPCOM ID Records and Let an Attacker Change 196 Passwords.

The center, known as DMDC, discovered the vulnerability on July 16, 2026, patched the system and restored it. An investigation then established that a small number of unauthorized users reached the files at some point between October 2025 and the day of discovery, a window of about nine months. The files were not encrypted. The scope figures come from a Defense Department official; the department now styles itself the Department of War in this administration's usage.

CNN reported the disclosure on September 25. TIME, ABC News and Federal News Network followed within days with the scope of the intrusion. Ars Technica reported on October 1 that the Pentagon had begun notifying "more than 2 million" people and described the breach as compromising "the records of 2.8 million living individuals."

The two sets of numbers describe the same event. The 2.76 million living and 294,000 deceased counts are the department's precise figures, a total of about 3.05 million records. "2.8 million" and "more than 3 million" are roundings. The difference is small, but it is worth watching which figure the department settles on.

What DMDC holds, and what leaked

DMDC is the Pentagon's central personnel-records operation, and it is enormous. In fiscal 2024 it held at least 60 million records covering military and civilian personnel, contractors, family members, retirees and veterans. A store that size is a different kind of target from a single agency's employee directory.

The mix of people in those records is part of what makes the incident awkward to handle. A DMDC file does not map neatly onto a list of current employees. It can include spouses and dependents, contractors who never wore a uniform, retirees who left decades ago, and veterans whose service predates modern identity protections. Notifying all of them accurately, and reaching people whose contact details may themselves be stale, is a slow exercise.

The exposed fields varied from person to person, but the department says each record contained a Social Security number plus at least one other identifier: name, date of birth, contact information, sex, race, and military personnel information such as occupational specialty.

Scale changes the nature of the harm. With at least 60 million records in one place, the collection is large enough that an intruder can look for patterns rather than individuals: current service members, particular units, specific job codes, recent retirees. That kind of filtering is what turns a bulk leak into a targeted one.

The lack of encryption matters too. It would not have stopped an intruder who reached an authorized file-sharing service with valid access, but it would have limited the value of any copied files. Without encryption, the data sat readable once access was obtained.

Why occupational specialty matters

Security Affairs singled out occupational specialty. It is the part of a record that helps a foreign intelligence service find the people it wants.

A Social Security number enables identity theft, which is bad enough for the individual. A job code plus a name plus an SSN enables targeting. Signals-intelligence operators, special-operations troops, cyber specialists and personnel tied to nuclear or missile programs are exactly the people whose occupational specialty makes them interesting to a foreign service. Someone holding the full dataset can filter for those codes at scale, then cross-reference names, birth dates and contact details to build a shortlist. That is the difference between a notification letter and a counterintelligence problem.

Not every affected record included the specialty, and the department has not said how many did. The exposure is variable, so the practical risk is variable too.

The value of a field like occupational specialty also grows with every other leak. A job code is more useful when it can be matched to a name, a birth date or an address that surfaced in a separate breach. Personnel data has a long shelf life, and records gathered years apart can be combined into a profile that no single disclosure would support.

A quiet intrusion beside a loud campaign

This is the second major U.S. federal breach disclosed in a month, and the two look nothing alike.

The extortion group ShinyHunters claimed it hacked FBI systems and stole records covering thousands of current or former FBI employees. Reuters reported the records included job titles tied to investigations of China or Russia. Dutch police arrested an alleged ShinyHunters member, a 24-year-old man in Amsterdam. Brett Leatherman, an assistant director in the FBI's Cyber Division, released a video urging group members to turn themselves in.

"The longer you stay in this, the more we learn about you... we know how to find you. I suggest you reach out first while the choice is still yours." — Brett Leatherman, assistant director, FBI Cyber Division

ShinyHunters wants attention, and its campaign arrived with a public claim, a named victim and an arrest. The DMDC intrusion arrived the opposite way: no claim, no named perpetrator, and no public account of how it happened. For defenders, the quiet case is the harder one to work, because there is no criminal persona to trace and no ransom note to analyze.

The two campaigns also differ in what they give investigators. A public claim, even a self-serving one, offers a starting point: a group to track, infrastructure to map, a motive to test. An intrusion with no claim offers none of that. The DMDC case has to be reconstructed from logs and system forensics, and the department has not said what those showed.

The OPM precedent

The 2015 breach of the U.S. Office of Personnel Management is the comparison that has recurred in coverage of the DMDC case. Hackers tied to the Chinese state obtained 22.1 million records from background checks, including fingerprint data, and the case remains the measure of damage to U.S. government personnel data. By that standard the DMDC numbers, even at roughly 3.05 million, are being read seriously rather than as another routine tally.

OPM also exposed more than identities: it revealed who worked on what, the same category of insight that occupational specialty provides here. The DMDC scale is smaller. The sensitivity per record overlaps.

In both cases, the leaked data is permanent in a way a password is not. A Social Security number cannot be reissued, and a leaked job title and date of birth do not expire. Personnel breaches are treated as a lifelong risk for that reason.

What remains unknown

No known cybercrime group has claimed responsibility for the DMDC breach. The Pentagon has not said how attackers got in, whether it has contacted those responsible, or whether there were any ransom demands.

Officials say the stolen data has not been misused. They have not explained how they reached that conclusion. Proving a negative about stolen personal data is close to impossible: misuse often surfaces months or years later as fraud, phishing or targeting, and a nine-month window of undetected access is long enough that a lack of observed misuse so far is not strong evidence of its absence.

Nine months is a long window. It gave the intruders time to copy files, widen access and cover traces, and it stretched the period in which any misuse could have been set up. Officials have not said what the logs showed.

What affected people should do

Anyone told they are affected should enroll in the credit monitoring DMDC is providing through IDX, and should do so before the August 19, 2027 deadline rather than at the last minute. A credit freeze at the major bureaus is a stronger control than monitoring, though it has to be lifted whenever the person applies for credit. Monitoring is useful mainly because it surfaces an account opened in someone else's name after the fact.

Because the leaked records pair an SSN with a name and, in many cases, contact details, the likeliest misuse is identity fraud and targeted phishing rather than a one-time account takeover. Phishing that cites a real job code and a real unit is more convincing than a generic lure, and it is the kind of thing that will not show up in a credit report. Affected people should treat unexpected messages about their service history with more suspicion than usual.

What to watch

Three things are worth tracking. Attribution: whether the U.S. government names a culprit or formally links the intrusion to a state or criminal group. Scope correction: whether the 2.76 million figure holds once notification is complete, or whether the department revises it as OPM's numbers were revised. And explanation: whether officials offer any support for the claim that the data has not been misused, or leave it as an assurance without evidence.

File-sharing systems are a recurring weak point in large organizations for a simple reason. They exist to move documents between people, which means they are built to be reachable and to hold data in usable form. A control that makes a file share safer, such as requiring explicit authorization for every file and encrypting everything at rest, also makes it less convenient. That tension is why shared repositories, rather than hardened databases, appear so often in breach disclosures. The department has not described the specific DMDC flaw, but the outline, an unencrypted store reachable by unauthorized users for months, follows a familiar shape.

Formal attribution would be a significant step. Naming a state or a criminal group is a political and legal act as much as a technical one, and governments often wait for an assessment they are willing to stand behind. A public claim by a group, or an arrest, would be a faster signal. So far there is neither, which leaves the incident without a public answer to its most basic question: who took the files.

Until that pattern changes at federal personnel agencies, the notification letters will keep going out.

Cover: A U.S. service member inserts a Common Access Card into a keyboard. Photo via the U.S. Marine Corps, public domain.