A breach of a Pentagon personnel database exposed sensitive personal information belonging to more than 3 million people, including 2.76 million living individuals and 294,000 deceased individuals, a Defense Department (DOD) spokesperson told MeriTalk on Sept. 29.
Under the Trump administration, the DOD was rebranded as the War Department.
The Defense Manpower Data Center (DMDC) information system experienced unauthorized access to personally identifiable information by a small number of unauthorized users between October 2025 and July 2026, according to the spokesperson.
DMDC discovered the vulnerability in a file-sharing system on July 16, 2026, according to a breach notification sent to an affected individual. The department said it immediately remediated the vulnerability.
“Upon discovery, DMDC immediately remediated the vulnerability,” the spokesperson said, adding that the department “does not have any indications of misuse of the accessed information” at this time.
DMDC oversees identity verification for DOD ID card holders and maintains records on more than 60 million troops and veterans, current and former civilian employees, contractors, and military family members.
The department is notifying individuals whose personally identifiable information was accessed by postal mail through its contracted provider, Identity Theft Guard Solutions (IDX).
One notice sent to an affected individual and posted to Reddit says the information exposed varied by individual. In this recipient’s case, the notice says the compromised information included a Social Security number and at least one additional identifier, such as a name, date of birth, contact information, sex, race, or military personnel information, including occupational specialty.
DMDC also initiated privacy and cybersecurity incident response actions and is taking steps to assess and strengthen the system’s cybersecurity, according to the notice.
“IDX will provide notification, credit monitoring, and identity restoration support to affected individuals based on the data elements impacted for each individual,” the DOD spokesperson said.
The department is offering 12 months of credit monitoring services through IDX, according to the notice. Affected individuals have until Aug. 19, 2027, to enroll.
Individuals with questions can contact IDX at response.idx.us/DMDC or 1-855-744-4556.
The DMDC breach comes amid other recent cyberattacks targeting government personnel data. About a week earlier, the cybercriminal group ShinyHunters claimed it compromised the FBI’s jobs portal and obtained personally identifiable information. The FBI said it is investigating the incident but has not determined whether the point of compromise was the bureau’s systems or a third-party provider.
The incidents are raising broader questions about how agencies and their contractors protect large stores of sensitive personnel data, particularly as cybercriminal groups increasingly target identity information.
In response to the DMDC breach, Gary Barlet, public sector chief technology officer at Illumio, told MeriTalk, “The public is becoming numb to the exposure of sensitive data because it keeps happening.”
“The uncomfortable reality is that there aren’t enough consequences for failing to protect that data,” Barlet said. “Until organizations are held accountable for the impact of breaches, many will continue treating cybersecurity as a compliance exercise rather than a resilience imperative.”
Barlet also said that organizations need to focus less on preventing every breach – an outcome he called unrealistic – and more on limiting the damage when attackers gain access.
“We need to change how we define success. The goal isn’t a world with no breaches,” he said. “The goal is a world where a breach doesn’t become a catastrophe. The organizations getting security right aren’t the ones claiming they’ll never be compromised. They’re the ones prepared to contain the damage when it happens.”