According to Military Times, a September 18 notification letter from the Defense Manpower Data Center (DMDC) says it found a vulnerability in a file-sharing system on July 16 and that unauthorized users accessed files with unencrypted personal data on a server between October 2025 and July 16, 2026 [1]. A Pentagon official told Federal News Network the breach exposed names, contact details, birth dates, Social Security numbers, military jobs and other records of nearly 2.8 million living and 294,000 deceased people, with no indication of misuse, and declined to say who accessed the data [2][3]. Recipients of the notice can enroll in 12 months of free IDX credit monitoring by August 19, 2027 [2][3].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Sep 25, 2026 and we added it on Nov 11, 2026. It is not a new event.
CriticalMonitoringBackfillMedia reported
Flaw in US Defense Manpower Data Center file-sharing system exposed unencrypted SSNs and military records of over 3 million people for almost a year
1 min read
- Disclosed
- Sep 25, 2026
- Occurred
- Oct 1, 2025
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 3,054,000 people[2]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Government, Defense
What to do nowOur advice
- Recipients of the DMDC notice should enroll in 12 months of free IDX credit monitoring by August 19, 2027 .
Timeline
Technical details
Remediation
References
Media3
- [1]
“The Defense Manpower Data Center, or DMDC, discovered the vulnerability on July 16 in a file-sharing system, according to a notification sent Sept. 18”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.