The U.S. Department of Defense has disclosed a significant data breach impacting millions of current and former military personnel. Unauthorized actors exploited a vulnerability in the Pentagon’s file-sharing system between October 2025 and July 2026, accessing unencrypted personnel records. These files contained sensitive personal details including names, Social Security numbers, birth dates, race, sex, and military service information. The breach affects approximately 2.8 million living individuals and nearly 300,000 deceased, raising concerns about the security of this data.

The compromised records were maintained by the Defense Manpower Data Center (DMDC), a key DoD unit responsible for identity management and benefits for service members, civilian staff, and their families. The DMDC manages over 60 million records and controls credentials used to access Pentagon systems and facilities. Despite the breach, the Department of Defense has stated there is no evidence yet of data misuse but has provided limited information on how it reached that conclusion or the identity of the hackers.

This breach is the latest in a troubling string of cyberattacks targeting federal workers’ personal data. Just weeks earlier, the FBI suffered a similar intrusion attributed to the hacker group ShinyHunters, which compromised agent and staff details. Such incidents pose severe national security risks, especially if foreign adversaries use the stolen information to target personnel or conduct counterintelligence operations.

Historical parallels highlight the severity of the situation, recalling the 2015 Office of Personnel Management breach, which exposed over 22 million government employees’ records and was linked to Chinese hackers. As the government grapples with these ongoing cybersecurity challenges, affected individuals have been notified and urged to take precautions. The DoD and DMDC face mounting pressure to bolster defenses and prevent future data compromises.