Pentagon DMDC Data Breach 2026: Who Is Affected, What To Do

The Pentagon's Defense Manpower Data Center (DMDC) has confirmed that a breach exposed the personal records of 2.76 million living people and 294,000 deceased people. Unauthorized users could read files on a DMDC server from October 2025 until the hole was found on July 16, 2026. The files held Social Security numbers and were not encrypted.[1][2][3]

If you served in the US military, worked for the Defense Department, or are a family member of someone who did, treat this as a real risk to your identity. Below you will find the facts that have been confirmed, what data was in the files, who is affected, what is still unknown, and six free steps you can take today. Every step is sourced to the FTC, the IRS or the reporting we link at the end.

Pentagon DMDC breach timeline

The dates below come from the letters that recipients shared online and from what a Pentagon official told reporters.

• October 2025. According to the letters, unauthorized users start accessing files on a DMDC server that holds unencrypted personal data.[2][4]
• July 16, 2026. DMDC discovers a security vulnerability in a file-sharing system. A recipient's notice says it was patched immediately.[3][4]
• September 25, 2026. A Pentagon official confirms the scale to CNN: 2.76 million living and 294,000 deceased people.[2]
• September 28, 2026. Federal News Network reports that a Pentagon official put the total above three million and described access that lasted nearly a year.[3]
• September 30, 2026. TechCrunch reports that the government is alerting current and former service members and staff, and that a Department of Defense spokesperson confirmed the numbers by email.[1]

What happened at the Defense Manpower Data Center

DMDC is the central records unit of the Defense Department. It keeps more than 60 million records on troops, veterans, current and former civilian employees, contractors and military family members, and it handles identity verification for everyone who holds a Defense Department ID card.[3][1] The unit also issues the credentials, such as smart cards, that open Pentagon computer systems, buildings and bases.[1]

The notification letters say DMDC found a vulnerability in one of its file-sharing systems on July 16, 2026. The letters add that a small number of unauthorized users had looked at files on a server containing unencrypted personal data since October 2025.[2][4] A Pentagon official told Federal News Network that those users had access for nearly a year, and that the exposed information differs from one person to the next.[3]

The official declined to answer several questions: who accessed the data, whether the people affected belong to a particular group, whether the breach was intentional, and why personal information was stored on an unencrypted server.[3] A Department of Defense spokesperson confirmed the numbers to TechCrunch but did not answer questions about whether officials had heard from the attackers.[1]

One more detail helps avoid confusion. Federal News Network separately reported a documentation problem affecting the records of hundreds of thousands of troops who needed corrected files to hold a Common Access Card. A Pentagon official said on September 3 that there was no indication of foul play or of a data breach in that case.[3] That issue is separate from the breach described here.

What data was exposed in the DMDC breach

The letters and the reporting agree on the core of it: a Social Security number paired with identifying details. The mix is different for each person, so your own letter is the best guide to what was in your file.

Two of these items cannot be replaced. A date of birth never changes, and a Social Security number can be changed only in limited circumstances.[4] That is why this breach is a long-term risk and why a credit freeze matters more than a password change.

Who is affected by the Pentagon data breach

The group can include current and former defense personnel and their dependents, along with people who have died.[2] The number of living people is reported as 2.76 million by CNN and as nearly 2.8 million by Federal News Network and TechCrunch.[1][2][3]

The reports we read do not mention a public lookup tool where you can type a name or Social Security number. DMDC is contacting people by letter. If you served or worked for the Defense Department and have not received one, do not wait for it. The steps below cost nothing and protect you whether or not your record was in the files.

What attackers can do with this data

This section is our analysis of the risks, based on what the data allows and on the guidance of the security researchers who covered the breach.

• Open new credit in your name. A Social Security number, a name and a date of birth are the core of most credit applications. A credit freeze blocks this.
• File a tax return in your name. The same details are enough to file a false return and claim a refund. An IRS Identity Protection PIN blocks this.[5]
• Write convincing phishing messages. Knowing a person's job specialty, and in some records contact details, lets a scammer name your unit, rank or role in an email, call or text. Malwarebytes advises treating any unexpected message that mentions these details with suspicion.[4]
• Track and profile personnel. Malwarebytes notes that the data could help foreign intelligence services track US personnel, and points to military leaders' concerns about commercial location data being used to target them.[4]

What to do if you may be affected: six free steps

1. Freeze your credit at all three bureaus. A freeze tells the credit bureaus not to share your report with anyone opening a new account, which stops most new-account fraud. It is free by federal law since 2018.[6][7] You must contact Equifax, Experian and TransUnion separately, and you can lift the freeze for a short time when you apply for credit yourself. Our guide walks through it: How to freeze your credit.

2. If you are on active duty, add an active duty fraud alert. The alert is free and lasts one year, and you can renew it for the length of a deployment. You contact one bureau and it must tell the other two. It also removes you from the bureaus' marketing lists for prescreened credit and insurance offers for two years. Active duty members and National Guard members can also get free electronic credit monitoring by contacting each of the three bureaus.[6]

3. Get an IRS Identity Protection PIN. Anyone with a Social Security number or an ITIN who can verify their identity can enroll. The six-digit PIN is needed to file your federal return, so someone who holds your Social Security number still cannot file in your name.[5]

4. Use the IDX credit monitoring if you were offered it. DMDC pays for 12 months.[3] Monitoring tells you after something has happened, while a freeze prevents new accounts, so use both.

5. Distrust anything that mentions the breach. Do not click links in emails or texts about it. Use only the phone number or address printed in your own letter, and look up official contacts yourself. If someone approaches you in a way that feels wrong, military personnel should report it to their security officer.[4] Our guides explain how to report phishing and how to report cybercrime.

6. Read your credit reports. Look for accounts, addresses or inquiries you do not recognize. The official free source is annualcreditreport.com. Also use a unique password and multi-factor authentication on your email, bank and benefits accounts, because stolen identity details make account recovery scams easier.[4]

If someone has already used your identity, report it to the Federal Trade Commission at IdentityTheft.gov and place the alerts above. If you paid someone who contacted you about the breach, read what to do after paying a scammer right away.

Scams to expect after the DMDC breach

Breach notices are a favorite cover for phishing, because people are already worried and expect a message. Malwarebytes reported on October 1 that customers of Free Mobile received very convincing phishing emails days after a data breach at that company.[8] The reports we read do not yet describe scams that use the DMDC breach, but the same pattern is likely to follow.

• A call, text or email that claims to be DMDC, the Pentagon, IDX or a credit bureau and asks for your Social Security number, a payment or a login.
• A message that names your unit, rank or job to prove it is real. That detail may come from the stolen files.
• An offer of paid identity protection that says the free IDX monitoring is not enough.
• A link that asks you to 'verify' your account to receive your notification letter.

Before you open a link in any message about the breach, paste the address into our website safety checker to see whether the domain is known to be dangerous.

How this breach compares with other recent incidents

TechCrunch calls the DMDC case the latest in a run of thefts of federal workers' data and notes that the FBI incident was billed as a counterintelligence problem, because personnel records can be used to profile or pressure people who hold sensitive jobs.[1] Denmark's case shows a different weak point: an attacker who borrows a trusted supplier's access can search a national register at scale. Danish officials said the breach involved a very large number of automated searches aimed at finding valid CPR numbers, and that the 10-digit numbers, which begin with a date of birth, are meant to last a lifetime.[9]

For a running list of confirmed incidents, see our data breaches hub.

What is still unknown

• Which file-sharing system was involved and which vulnerability was used.
• Who the unauthorized users were, and whether they acted for a state or for criminals.
• Whether files were copied or only viewed. Help Net Security notes that DMDC has not said, while TechCrunch reports that the government is describing the information as stolen.[1][2]
• Why personal data, Social Security numbers included, was held unencrypted on that server.[3]
• How many of the 3.05 million people have been notified, and whether any misuse has occurred.
• Whether a lookup tool will be offered so people can check their own status.

We will update this article when DMDC or the Pentagon publish more. It was last checked on October 6, 2026.