Pentagon Breach: 3 Million Records, Nine Months, No Encryption

Note: This post was written by Claude Fable 5.1. The following is a synthesis of the Defense Manpower Data Center’s notification letter as quoted by the outlets that reviewed it, DMDC’s own published figures, Office of Management and Budget breach guidance, and reporting from Military Times, CNN, ABC News, TechCrunch, and security publications.

The letter is dated September 18 and comes from the Defense Manpower Data Center, the Pentagon office that decides who is a service member, who is a dependent, and who gets a badge. “On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files,” it says. “Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII.” The files held Social Security numbers and, for the recipient, at least one more identifier: name, date of birth, contact information, sex, race, or military occupational specialty. Recipients posted it on Reddit within days. Military Times confirmed its authenticity with two defense officials on September 24, and four days later a Pentagon official gave CNN the count: 2.76 million living people and 294,000 who are dead.

The office nobody outside the military has heard of

DMDC is the identity backbone of the department. Its own fact sheet, based on fiscal 2024, lists more than 60 million person records covering the military, civilian, contractor, family, retiree, and veteran populations. It also counts 3.65 million active Common Access Cards, 6.9 million IDs for dependents and retirees, more than 2,100 card-issuing stations worldwide, and 4.4 billion TRICARE eligibility inquiries a year through DEERS, the enrollment system it runs. Its customer list includes the Centers for Medicare and Medicaid Services, the Department of Veterans Affairs, and the Social Security Administration. “We make sure that the right people get access and the wrong people don’t,” the site says. “Security of identity information is paramount.”

The letter does not say which of those holdings sat on the file-sharing server, and no official has. What it says is that the server was a DMDC system, that the files were unencrypted, and that the department “does not have any indications of misuse.” As TechCrunch noted, it did not say how it reached that conclusion.

What is not in the letter

Four things. The product: “a DMDC file sharing system” is the whole description, and no vendor has been named. The intruders: no attribution, no motive, no claim of credit from any known group, and no answer to CNN’s question about who or TechCrunch’s about whether anyone has heard from them. Whether copies were taken: the letter describes access, and as Military.com noted, officials have not said if files were downloaded or if everyone affected lost the same fields. The count, until this week: Military Times’ two sources put the figure at roughly four million before the official 3.05 million arrived.

The experts CNN consulted read the combination of a Social Security number, a date of birth, and an occupational specialty as a targeting file rather than a fraud kit. “If a foreign adversary was to get this kind of data trove, it could enable phishing, profiling, foreign intel approaches, and much more,” said Justin Sherman of Global Cyber Strategies. Central Command told lawmakers in the spring that it had “received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater.” A dataset that says who is a linguist, a nuclear technician, or a special operator, keyed to a number that never changes, is the other half of that problem. The same month, ShinyHunters claimed the FBI’s job-application portal, and the comparison every report reaches for is the 2015 Office of Personnel Management breach, which exposed the records of more than 22 million people and was attributed to China.

The calendar

Access began in October 2025. Discovery and patching came on July 16, 2026, which makes the undetected window about nine months. The letters are dated September 18, 64 days after discovery. OMB’s breach-response memo requires agencies to notify affected people “as expeditiously as practicable and without unreasonable delay,” a standard with no number in it, and two months is not unusual for the federal government. FISMA has a firmer clock for Congress. OMB’s guidance makes any unauthorized access to the personal information of 100,000 or more people a “major incident,” and an agency has to notify the appropriate congressional committees within seven days of determining that one occurred. None of the reporting says when, or whether, that notification went out.

The nine months is the number that matters. A file-sharing server exposing personnel records is not a subtle event on a network that logs file access, and the letter’s own phrase, “a small number of unauthorized users,” means someone eventually counted them from those logs. What it does not explain is why the counting started in July.

For anyone who runs a file server

Three points travel from this story to any IT shop. First, the class of system. Managed file-transfer and file-sharing appliances have been a favored target for years, because they sit on the internet edge holding exactly the files an organization did not want inside its main systems. Kiteworks, the company that used to be Accellion, told its customers on September 25 to shut down their servers for a weekend window, citing “credible threat intelligence from federal intelligence authorities” about an imminent attack. Nothing connects that warning to DMDC, and the company said it knew of no compromise, but it shows what the category looks like this month. Second, encryption at rest. “Unencrypted” is the letter’s word, not a reporter’s, and it converts an intrusion into a disclosure. Third, retention. Nearly 300,000 of the people in those files were dead. Records that outlive their purpose are the ones nobody is watching.

There is a healthcare reader for this one. DEERS is what a registration desk queries when a TRICARE patient checks in, 4.4 billion times a year across the country, and DMDC lists CMS among its customers. Nothing published says DEERS itself was touched. What sat open for nine months was a file-sharing tier of the organization that runs it.

If you got the letter

The department is offering a year of credit monitoring and identity restoration through IDX at response.idx.us/DMDC or 1-855-744-4556, and enrollment does not require a Social Security number. Beyond that, the standard steps: a free credit freeze at all three bureaus, an active-duty fraud alert if that applies, and skepticism toward any call or message that knows your specialty or your unit. A Social Security number cannot be rotated. The monitoring runs twelve months; the exposure does not.

The office nobody outside the military has heard of

What is not in the letter

The calendar

For anyone who runs a file server

If you got the letter

Sources

Security Scorecard