Unauthorized users read unencrypted Social Security numbers on a Pentagon DMDC personnel file server for nine months; a defense official counts about 3 million people affected
Unauthorized users accessed unencrypted personal data on a Pentagon HR file-sharing server for nine months before discovery
Analysis
Unauthorized users accessed files holding unencrypted personal data on a vulnerable file-sharing server of the Defense Manpower Data Center (DMDC), the Pentagon's central personnel-data repository, from October 2025 until DMDC discovered the vulnerability on 16 July 2026 and patched it, and the notification letter says they reached its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24 · CNN, 2026-09-25). A U.S. defense official put the count at 2.76 million living and 294,000 deceased people, and no report names a vulnerability class, access vector or actor (ABC News, 2026-09-29). The lesson for public administrations: unauthorized users accessed unencrypted identity data in a government's central personnel-data store for nine months before the Pentagon discovered and remediated the issue (CNN, 2026-09-25).
Cited evidence
“Unauthorized users” gained access to a vulnerable computer server belonging to the Defense Manpower Data Center (DMDC) beginning last October, but it wasn’t until nine months later, in July, that the Pentagon discovered and remediated the issue, according to a letter the center sent to victims of the breach reviewed by CNN.
The unauthorized users gained access to the Social Security number of the letter’s recipient, as well as at least one additional piece of identifying information, such as a name, date of birth, contact information, sex, race or military personnel information, including occupational specialty, according to the notification.
The stolen data wasn’t encrypted, according to the letter.
Two people familiar with the incident told Military Times that approximately four million Defense Department personnel may be affected.
The breach affected 2.76 million living people and another 294,000 who are deceased, the official said.
A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026.
Updates4
A U.S. defense official told ABC News the breach affected 2.76 million living and 294,000 deceased people, against the roughly four million earlier reported, and described access by "a small number of unauthorized users" between October 2025 and July 2026 that DMDC remediated on discovery (ABC News, 2026-09-29 · Military Times, 2026-09-24).
Military Times quotes the notification letter as exposing its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24). The entry previously generalised this to every affected person and advised access logging, which no cited report discusses. CNN reports that the data was not encrypted and that encrypting sensitive data is a standard security practice (CNN, 2026-09-25).
Military Times reports that unauthorized users reached files "on a server containing unencrypted personally identifiable information" through a vulnerability in a file-sharing system (Military Times, 2026-09-24). The data was unencrypted; no report says whether the server was reachable from outside DMDC's network.
The nine months CNN reports run from the start of unauthorized access in October 2025 to July 2026, when the Pentagon discovered and remediated the issue; CNN reports that the stolen data was not encrypted and that encrypting sensitive data is a standard security practice (CNN, 2026-09-25).
Sources4
Revision history
- Published 2026-09-27T0404Z-intel
- Update 2026-09-30T0404Z-intel
A U.S. defense official told ABC News on 2026-09-29 that the DMDC breach affected 2.76 million living people and another 294,000 who are deceased, replacing the earlier estimate of about four million from two unnamed people. The official's statement describes unauthorized access by a small number of unauthorized users between October 2025 and July 2026 and says the vulnerability was remediated on discovery.
Changed: title summary sources evidence body
- Correction 2026-09-30T0639Z-audit
Priority is lowered from high to routine: a US military data breach with no vector or tradecraft defenders can act on. The title, summary, body and the earlier 2026-09-30 update section are trimmed to routine-incident length, and the sourcing note is plain provenance. The exposed data is now described as the letter recipient's rather than every affected person's, and the takeaway drops an access-logging recommendation no source makes.
Changed: priority sourcing_note title summary body
- Correction 2026-10-11T1307Z-audit
The headline said the server was unencrypted and reachable; the reporting says unauthorized users accessed files holding unencrypted personal data through a vulnerability in a file-sharing system, and no report says whether the server was reachable from outside DMDC's network.
Changed: headline
- Improvement 2026-10-21T0800Z-audit
The nine months is the period of unauthorized access, from October 2025 until the Pentagon discovered and remediated the issue in July 2026, not a stated period for which the data sat unencrypted. The takeaway follows CNN: encrypt sensitive personnel data, which the stolen data lacked.
Changed: body summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.