VULNpocalypse
HighBreach / campaignMonitoring

Pentagon DMDC breach: SSNs of about 3 million people read from a file-sharing server for nine months

A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted SSNs of about 3.05 million people with military ties, Oct 2025 to Jul 2026.

Published
Updated
Exploitation
Yes. A “small number of unauthorized users” accessed files from October 2025 until 16 July 2026

What happened

The Defense Manpower Data Center (DMDC) holds the Pentagon’s central personnel records: more than 60 million records on troops, veterans, civilian employees, contractors, family members and retirees (Stars and Stripes).

Timeline:

  • October 2025 to 16 July 2026: “a small number of unauthorized users” accessed files on a DMDC server holding unencrypted personal data (Military Times).
  • 16 July 2026: DMDC discovered a “security vulnerability in a DMDC file sharing system” that “allowed unauthorized users to access files”, patched it and restored the system (SecurityWeek).
  • 18 September 2026: date of the notification letters. A recipient posted a copy online (SecurityWeek).
  • 24 September: Military Times reported the letter; two defense officials confirmed it was authentic. Two people familiar with the incident said “approximately four million” people may be affected (Military Times).
  • 25 to 28 September: a Department of War official told CNN the breach affects 2.76 million living and 294,000 deceased people (SecurityWeek). A Pentagon official confirmed “more than 3 million” to Federal News Network (Federal News Network).

What was exposed. Social Security numbers plus at least one of: name, date of birth, contact information, sex, race, and military personnel information such as occupational specialty. The mix varies by person (Military Times; Stars and Stripes).

How they got in. Only “a security vulnerability” in a file-sharing system. The product and the flaw have not been named (SecurityWeek). The official who spoke to Federal News Network declined to say who accessed the data, whether it was intentional, or why the data was stored unencrypted (Federal News Network). No group has claimed it.

What DMDC says. “At this time, DoW does not have any indications of misuse of the accessed information” (SecurityWeek). DMDC is offering 12 months of credit monitoring and identity restoration through IDX, with an enrollment deadline of 19 August 2027 (BleepingComputer). As of 30 September there was no official news release from the Pentagon or DMDC (MOAA).

Am I affected?

  • You got a letter dated 18 September 2026 from DMDC: yes. The letter carries your enrollment code.
  • You have military ties but no letter: DoD has not said which groups were in the exposed files. The official who spoke to Federal News Network declined to say whether those affected belong to a particular group (Federal News Network). Stars and Stripes describes those affected as troops and civilian employees (Stars and Stripes). The total is still uncertain (about 3.05 million per the DoW official, about 4 million per Military Times’ sources), so some people may not yet have been notified.
  • A relative who died: 294,000 records belong to deceased people. How next of kin will be told has not been disclosed.
  • Checking the letter is real: the IDX enrollment site named by MOAA is https://response.idx.us/DMDC (MOAA). Do not enroll through any other link, phone number or QR code that arrives in a message.

What to do now

  1. Enroll in IDX by 19 August 2027 at response.idx.us/DMDC, typing the address yourself and using the code in your letter (MOAA; BleepingComputer).
  2. Freeze your credit at Equifax, Experian and TransUnion. With your SSN and date of birth exposed, a freeze blocks new accounts in your name; monitoring only tells you after the fact. Active and reserve service members are already eligible for free credit monitoring from all three bureaus (MOAA).
  3. Expect lures that quote your service details. The exposed data includes occupational specialty and demographics, so a message that names your MOS or unit is not proof it is genuine.
  4. Report identity theft at identitytheft.gov if you find accounts you did not open (MOAA).
  5. If you run file-sharing or file-transfer servers for an agency or contractor: this exposure ran for nine months on unencrypted files. Find which shares hold files with SSNs, encrypt them or move them off the share, and confirm your access logs go back far enough (at least a year) to answer “who downloaded what since October 2025” if you are asked.

Sources