A data breach involving a Defense Department database has exposed personal information, including Social Security numbers, of over 3 million government employees, both military and civilian.
Of those impacted, 2,760,102 were living, while 294,311 were deceased, according to a U.S. Defense Department spokesperson.
The affected database is the Defense Manpower Data Center (DMDC).
This breach involved unauthorized access to personal information for several months before it was detected and secured.
The Defense Department reported that the breach occurred between October 2025 and July 2026, when unauthorized individuals accessed personally identifiable information.
On July 16, the DMDC began updating its file-sharing system to close the security gap and restore the database after the breach was discovered.
It was determined that only a few unauthorized individuals accessed unencrypted files containing personal information.
However, the Defense Department has not yet identified those responsible for the breach or assessed the full extent of the damage.
The exposed information varied among individuals and included:
- Names
- Social Security numbers
- Birth dates
- Contact information
- Demographic data
- Military occupational specialties, among other personal details.
The mix of personal and professional information raises concerns about identity theft and phishing scams.
Despite this, the U.S. Defense Department stated there is no evidence that the exposed information has been misused.
The DMDC holds over 60 million records, covering a large part of the U.S. defense community, including active-duty service members, civilians, contractors, veterans, retirees, and military families.
Officials believe not all records in the DMDC were compromised during the breach.
The breach came to light when an affected individual received an email notification from the DMDC.
Those impacted by the breach will be informed.
Additionally, the Pentagon is providing identity protection and credit monitoring services to those whose information was disclosed.
However, the Pentagon has not named the perpetrators or specified the compromised file-sharing system involved in the cyberattack.
There have been multiple recent cybersecurity incidents affecting defense systems and databases containing personal information.
Concerns about the security of systems holding personal data have been raised since the DMDC’s database was compromised.
Defense officials have stated they are taking steps to close security gaps and enhance cybersecurity measures at the DMDC.
An investigation into the breach is ongoing, and the affected individuals’ information is being assessed for potential misuse.