The U.S. Department of Defense says hackers steal personal information from millions of current and former military personnel in a months-long breach. The affected organization is the Pentagon’s Defense Manpower Data Center (DMDC), which handles records used for benefits and entitlements.
Multiple outlets report that the attackers exploited a file-sharing vulnerability and accessed unencrypted records over several months, from October 2025 to July 2026. Reported exposure includes Social Security numbers, dates of birth, demographic details, and military service information. One outlet also reports that records for nearly 300,000 deceased individuals were included, bringing the total described to about 2.8 million living people plus those deceased.
The outlets also note the DMDC’s role as a major identity management provider for linking service members, employees, and contractors to credentials used to access Pentagon systems and facilities. The Department of Defense says it has no indication the stolen information has been misused, though it does not provide details on how that determination is made. Hackers’ identities are not publicly known, and one outlet reports it did not receive responses to questions about communications from the attackers.
