Hackers stole the unencrypted personal records of approximately 2.8 million living U.S. military service members and veterans, along with roughly 300,000 deceased individuals, during a nine-month breach of a Pentagon file-sharing system that ran undetected from October 2025 until mid-July 2026.
The Defense Manpower Data Center, the Pentagon office that maintains personnel records, began notifying affected individuals after unauthorized users exploited a security vulnerability in an unspecified file-sharing system, according to a breach notification circulated on Reddit and confirmed by CNN and Federal News Network. A Pentagon official put the total number of affected living people at about 2.8 million.
Stolen data includes Social Security numbers, names, dates of birth, sex, race, and details of military service. The records were not encrypted at the time of the theft, according to the DMDC notice.
The breach is the latest in a series of thefts involving federal workers' data in recent months, and it ranks among the largest single exposures of military personnel information in recent years. Social Security numbers are among the most valuable identifiers for identity thieves because they can be used to open credit accounts, file fraudulent tax returns, and pass identity verification checks.
The DMDC notification did not name the file-sharing system involved or identify who carried out the intrusion. The Pentagon has not publicly disclosed how the vulnerability went undetected for roughly nine months or whether the attackers were foreign or domestic.
Current and former service members whose information was exposed should monitor their credit reports and consider placing a freeze with the major credit bureaus, steps the DMDC notice is expected to outline. The department has not said whether it will offer free credit monitoring to those affected.
The breach follows reporting from TechCrunch's Zack Whittaker, who first detailed the notification on September 30, 2026. CNN and Federal News Network subsequently confirmed the scope of affected individuals with a Pentagon official.
