Unauthorized users read unencrypted Social Security numbers on a Pentagon DMDC personnel file server for nine months; a defense official counts about 3 million people affected
A vulnerable Pentagon HR file server sat unencrypted and reachable for nine months before anyone noticed
Analysis
Unauthorized users accessed files holding unencrypted personal data on a vulnerable file-sharing server of the Defense Manpower Data Center (DMDC), the Pentagon's central personnel-data repository, from October 2025 until DMDC discovered the vulnerability on 16 July 2026 and patched it, and the notification letter says they reached its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24 · CNN, 2026-09-25). A U.S. defense official put the count at 2.76 million living and 294,000 deceased people, and no report names a vulnerability class, access vector or actor (ABC News, 2026-09-29). The lesson for public administrations: a government's central personnel-data store kept identity numbers unencrypted and readable for nine months before discovery (CNN, 2026-09-25).
Cited evidence
“Unauthorized users” gained access to a vulnerable computer server belonging to the Defense Manpower Data Center (DMDC) beginning last October, but it wasn’t until nine months later, in July, that the Pentagon discovered and remediated the issue, according to a letter the center sent to victims of the breach reviewed by CNN.
The unauthorized users gained access to the Social Security number of the letter’s recipient, as well as at least one additional piece of identifying information, such as a name, date of birth, contact information, sex, race or military personnel information, including occupational specialty, according to the notification.
The stolen data wasn’t encrypted, according to the letter.
Two people familiar with the incident told Military Times that approximately four million Defense Department personnel may be affected.
The breach affected 2.76 million living people and another 294,000 who are deceased, the official said.
A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026.
Updates2
A U.S. defense official told ABC News the breach affected 2.76 million living and 294,000 deceased people, against the roughly four million earlier reported, and described access by "a small number of unauthorized users" between October 2025 and July 2026 that DMDC remediated on discovery (ABC News, 2026-09-29 · Military Times, 2026-09-24).
Military Times quotes the notification letter as exposing its recipient's Social Security number and at least one further identifying field (Military Times, 2026-09-24). The entry previously generalised this to every affected person and advised access logging, which no cited report discusses. CNN reports that the data was not encrypted and that encrypting sensitive data is a standard security practice (CNN, 2026-09-25).
Sources4
Revision history
- Published 2026-09-27T0404Z-intel
- Update 2026-09-30T0404Z-intel
A U.S. defense official told ABC News on 2026-09-29 that the DMDC breach affected 2.76 million living people and another 294,000 who are deceased, replacing the earlier estimate of about four million from two unnamed people. The official's statement describes unauthorized access by a small number of unauthorized users between October 2025 and July 2026 and says the vulnerability was remediated on discovery.
Changed: title summary sources evidence body
- Correction 2026-09-30T0639Z-audit
Priority is lowered from high to routine: a US military data breach with no vector or tradecraft defenders can act on. The title, summary, body and the earlier 2026-09-30 update section are trimmed to routine-incident length, and the sourcing note is plain provenance. The exposed data is now described as the letter recipient's rather than every affected person's, and the takeaway drops an access-logging recommendation no source makes.
Changed: priority sourcing_note title summary body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.