US Military Data Breach Exposes Personal Records Of More Than 3 Million Living And Deceased Personnel

A cyberattack on a US military personnel database has exposed the personal information of millions of people, with records belonging to both living and deceased individuals accessed over a period of about nine months.

The breach targeted a file-sharing system operated by the Defense Manpower Data Center (DMDC), one of the Pentagon’s main systems for managing personnel records.

Millions Of Military Records Exposed

According to a DMDC notification, unauthorised users exploited a security vulnerability that allowed them to access files containing unencrypted personal information.

The unauthorised access reportedly began in October 2025 and continued until the vulnerability was discovered on 16 July 2026.

The DMDC said it immediately patched the affected file-sharing system after discovering the issue and restored the system.

The notification, dated 18 September 2026, said a “small number of unauthorized users accessed files on a server containing unencrypted PII” between October 2025 and the date the vulnerability was discovered.

A Department of War official told CNN that the incident affected about 2.76 million living individuals and 294,000 deceased individuals, bringing the reported total to more than 3 million people.

The DMDC has not publicly identified the file-sharing product involved or explained the technical details of the vulnerability.

What Personal Information Was Accessed?

The exposed information varied between individuals but included highly sensitive personal and military records.

The data reportedly included Social Security numbers, names, dates of birth, contact details, sex, race, other demographic information and military occupational specialties.

The records were stored without encryption, meaning the information could be accessed in readable form once unauthorised users reached the affected files.

DMDC maintains a large database covering military and civilian personnel, contractors, family members, retirees and veterans.

Source: Hackers Online Club

Its website says the organisation held more than 60 million records as of fiscal year 2024, supporting areas including benefits, entitlements and identity management.

The agency states:

“We make sure that the right people get access and the wrong people don’t: security of identity information is paramount.”

DMDC Says No Misuse Has Been Found

Despite the scale of the exposure, the Department of War said it has not found evidence that the stolen information has been misused.

The DMDC notification says,

“At this time, DoW does not have any indications of misuse of the accessed information.”

The agency said it launched privacy and cybersecurity incident response measures after identifying the vulnerability.

Affected individuals are also being offered 12 months of credit monitoring, according to the notification.

However, officials have not disclosed who was behind the intrusion or what their motive may have been.

No known cybercrime group has publicly claimed responsibility for the DMDC incident.

Nine Months Of Unauthorised Access Raises Questions

The length of the intrusion is one of the key concerns surrounding the breach.

Unauthorised users reportedly had access from October 2025 until 16 July 2026, giving them months to access files stored on the vulnerable server.

Officials have not said exactly which files were taken, how much information was accessed or whether attackers attempted to move into other Pentagon-managed systems.

The incident comes shortly after reports of another major breach involving US federal employee data, although there is currently no indication that the DMDC incident is connected to that case.

The FBI breach was attributed to the ShinyHunters hacking group, but officials have not linked any known group to the DMDC attack.