CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Pentagon Defense Manpower Data Center (DMDC) personnel-data breach

incident · incident:pentagon-dmdc-military-personnel-breach-2026-09

Unauthorized users accessed an unencrypted DMDC file-sharing server between October 2025 and July 2026, exposing Social Security numbers and other PII of DoD military/civilian personnel; up to ~4 million people potentially affected, no attacker or mechanism disclosed (Military Times / CNN, 2026-09-24/25).

Aliases: DMDC breach, Pentagon HR breach 2026

Coverage
1
first 2026-09-27 → last 2026-10-21
Latest activity
2026-09-30
Unauthorized users accessed unencrypted personal data on a Pentagon HR file-sharing server for nine months…
Peak priority
routine
1 routine
Targets
defense
sectors: defense, public-sector · regions: us
Sources cited
4
4 hosts

Defender insights

What each entry about Pentagon Defense Manpower Data Center (DMDC) personnel-data breach tells a defender to do, newest first.

Story timeline

  1. 2026-09-27Unauthorized users read unencrypted Social Security numbers on a Pentagon DMDC personnel file server for nine months; a defense official counts about 3 million people affected
    active-threatsUnauthorized users accessed unencrypted personal data on a Pentagon HR file-sharing server for nine months before discovery

Hunting pivots

Tags
data-breach
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • CollectionData from Information Repositories

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-09-27/pentagon-dmdc-military-personnel-data-breach-unencrypted-ssn · ATT&CK page ↗

Entries about Pentagon Defense Manpower Data Center (DMDC) personnel-data breach (1)

2026-09-27 · view entry permalink →

ROUTINEupdatedNATOB1

Unauthorized users read unencrypted Social Security numbers on a Pentagon DMDC personnel file server for nine months; a defense official counts about 3 million people affected

Unauthorized users accessed files holding unencrypted personal data on a vulnerable file-sharing server of the Defense Manpower Data Center (DMDC), the Pentagon's central personnel-data repository, from October 2025 until DMDC discovered the vulnerability on 16 July 2026 and patched it, and the notification letter says they reached its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24 · CNN, 2026-09-25). A U.S. defense official put the count at 2.76 million living and 294,000 deceased people, and no report names a vulnerability class, access vector or actor (ABC News, 2026-09-29). The lesson for public administrations: unauthorized users accessed unencrypted identity data in a government's central personnel-data store for nine months before the Pentagon discovered and remediated the issue (CNN, 2026-09-25).

“Unauthorized users” gained access to a vulnerable computer server belonging to the Defense Manpower Data Center (DMDC) beginning last October, but it wasn’t until nine months later, in July, that the Pentagon discovered and remediated the issue, according to a letter the center sent to victims of the breach reviewed by CNN.

CNN 2026-09-25

The unauthorized users gained access to the Social Security number of the letter’s recipient, as well as at least one additional piece of identifying information, such as a name, date of birth, contact information, sex, race or military personnel information, including occupational specialty, according to the notification.

Military Times 2026-09-24

The stolen data wasn’t encrypted, according to the letter.

CNN 2026-09-25

Two people familiar with the incident told Military Times that approximately four million Defense Department personnel may be affected.

Military Times 2026-09-24

The breach affected 2.76 million living people and another 294,000 who are deceased, the official said.

ABC News 2026-09-29

A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026.

ABC News (statement attributed to a U.S. defense official)
Updaterun 2026-09-30T0404Z-inteltitlesummarysourcesevidencebody

A U.S. defense official told ABC News the breach affected 2.76 million living and 294,000 deceased people, against the roughly four million earlier reported, and described access by "a small number of unauthorized users" between October 2025 and July 2026 that DMDC remediated on discovery (ABC News, 2026-09-29 · Military Times, 2026-09-24).

Correctionrun 2026-09-30T0639Z-auditprioritysourcing_notetitlesummarybody

Military Times quotes the notification letter as exposing its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24). The entry previously generalised this to every affected person and advised access logging, which no cited report discusses. CNN reports that the data was not encrypted and that encrypting sensitive data is a standard security practice (CNN, 2026-09-25).

Correctionrun 2026-10-11T1307Z-auditheadline

Military Times reports that unauthorized users reached files "on a server containing unencrypted personally identifiable information" through a vulnerability in a file-sharing system (Military Times, 2026-09-24). The data was unencrypted; no report says whether the server was reachable from outside DMDC's network.

Improvementrun 2026-10-21T0800Z-auditbodysummary

The nine months CNN reports run from the start of unauthorized access in October 2025 to July 2026, when the Pentagon discovered and remediated the issue; CNN reports that the stolen data was not encrypted and that encrypting sensitive data is a standard security practice (CNN, 2026-09-25).

incident27 Sep 04:33Zmulti-sourceOpen finding →
Sources: Military Times · CNN · DataBreaches.net · ABC News

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • abcnews.com1 (25%)
  • cnn.com1 (25%)
  • databreaches.net1 (25%)
  • militarytimes.com1 (25%)
All cited sources (4)