Hackers spent months inside a system containing US military personnel records, stealing sensitive information belonging to roughly 2.8 million living people in one of the largest breaches of US government employee data in years.
The breach affected the Defense Manpower Data Center (DMDC), a Department of Defense organization that maintains personnel and identity information for service members, civilian employees, contractors and their families. Attackers exploited a vulnerability in an unspecified file-sharing system between October 2025 and mid-July 2026, giving them a remarkably long window to access government records.
Social Security Numbers and Military Records Exposed
According to breach notifications sent by the DMDC, the stolen information includes names, dates of birth, Social Security numbers, sex, race and details about individuals’ military service. The affected records were not encrypted.
The Pentagon says approximately 2.8 million living people were affected, along with records belonging to nearly 300,000 deceased individuals. The scale is significant when compared with the roughly 1.3 million active-duty service members currently serving in the US military.
The Department of Defense says it has no indication that the stolen information has been misused. The identities of the attackers remain unknown, and officials have not publicly disclosed exactly how the vulnerability was exploited or why the intrusion remained active for months.
The Target Was More Than a Personnel Database
The DMDC is particularly sensitive because it does more than maintain employment records. The organization holds more than 60 million records used to determine military benefits and entitlements, including healthcare and retirement.
It also plays a central role in identity management across the Department of Defense, linking military personnel, employees and contractors with credentials used to access Pentagon computer systems, buildings and military installations.
That makes the stolen information potentially valuable beyond ordinary identity theft. Detailed personnel records can help attackers construct convincing phishing campaigns, identify individuals with particular roles or access, and build profiles for future social-engineering operations.
The long-term intelligence value of personnel information can also outlast the initial breach. Names, employment histories, military affiliations and personal identifiers do not become irrelevant simply because passwords are changed.
Another Warning About Government Identity Data
The incident follows other major compromises involving US federal personnel information. Earlier in September, the ShinyHunters hacking group claimed responsibility for a breach affecting the FBI and said it had obtained personal information belonging to agents, employees and applicants.
The DMDC breach also recalls the 2015 compromise of the US Office of Personnel Management, when attackers stole records belonging to more than 22 million current and former federal workers. That breach was particularly serious because the compromised data included information associated with government security-clearance investigations.
Although the circumstances and attribution of the incidents differ, they demonstrate why personnel databases remain attractive targets. Attackers do not necessarily need classified documents when identity information can reveal who works inside sensitive organizations, what their roles are and how they might be approached.
Months of Access May Matter More Than the Initial Exploit
The most troubling aspect of the DMDC incident may ultimately be its duration. Attackers reportedly maintained access from October 2025 until July 2026, meaning the compromise potentially remained active for around nine months.
That raises questions beyond how the attackers initially entered. Investigators will need to determine what information was accessed during that period, whether additional systems were reached and whether credentials or other authentication material were exposed.
The breach is therefore another reminder that protecting identity infrastructure requires more than preventing account takeover. Organizations must also secure the systems that store the underlying information used to establish and manage those identities.
For the Pentagon, the immediate task is notifying millions of affected people. The longer-term challenge is understanding what adversaries might be able to do with a dataset describing a substantial portion of the US military community.
In breaches involving personnel information,the theft may happen once, but the intelligence value of the stolen data can persist for years.