Pentagon says hackers took records of about 3 million people over nine months
The U.S. Department of Defense is notifying about three million current and former service members, civilian staff and their families that their personal information was stolen from the Defense Manpower Data Center, a central Pentagon records unit, over a period of roughly nine months.
The data includes Social Security numbers and military service details that were stored without encryption, according to breach notices. TechCrunch compared it to the 2015 breach of the Office of Personnel Management, broadly attributed to China, which exposed records of more than 22 million U.S. government employees.
What happened
According to the notification letters, a small number of unauthorized users exploited a vulnerability in the data centre's file-sharing systems between October 2025 and July 2026. The intrusion was discovered on July 16. Pentagon officials told Federal News Network that nearly 2.8 million living people and about 294,000 deceased people are affected, BleepingComputer reported.
The exposed information varies by person and includes Social Security numbers, names, dates of birth, contact information, sex, race and military personnel details such as occupational specialty. The department said it has no indication the data has been misused but did not explain how it reached that conclusion, TechCrunch reported. Spokesperson Susan Gough confirmed the number affected.
The data centre maintains more than 60 million records on military and civilian staff, contractors, retirees, veterans and family members, and manages the identity credentials that control access to Pentagon systems and bases. It said it began incident response under federal guidelines and is working to strengthen the system's security.
What we don't know yet
The Pentagon has not identified the attackers or the file-sharing product involved, or said whether the hackers made contact or demanded money.
What to do
People who receive a letter can enrol in 12 months of free credit monitoring through IDX until Aug. 19, 2027. Anyone unsure whether they are affected should wait for an official letter rather than respond to unsolicited messages, since scammers often exploit breaches like this one. Consider a credit freeze, which costs nothing in the U.S. and blocks new accounts in your name.
