Someone was inside the Pentagon’s personnel files for 9 months before anyone noticed, and 2.76 million people’s Social Security numbers were exposed

A breach of the Pentagon’s personnel database exposed the Social Security numbers and job details of 2.76 million living people, along with 294,000 people who are deceased. The unauthorized access at the Defense Manpower Data Center, or DMDC, went unnoticed from October 2025 until July 16, 2026.

As reported by ABC News, a defense official said a DMDC system experienced unauthorized access of personal information by a small number of unauthorized users during that period. The breach was first reported by Military Times.

The DMDC serves as a central hub for identifying, authenticating, and authorizing Department of Defense personnel. It maintains more than 60 million records covering active-duty troops, reservists, civilian employees, contractors, retirees, veterans, and military family members.

The exposed files included details about people’s military jobs

Because the exposed files included details about the jobs held by those affected, the breach could raise national security concerns. According to a defense official, the breach was made possible by a vulnerability in a file-sharing system.

Once the DMDC discovered the issue on July 16, it patched the vulnerability and restored the system to a secure state. The department says there is currently no evidence that any of the exposed data has been misused.

The Department of Defense is offering one year of credit monitoring and identity-restoration services through a company called IDX. Notification letters, including one dated September 18, informed recipients that their Social Security number was accessed.

The letters also listed other personal identifiers that may have been exposed, such as full name, date of birth, contact information, sex, race, or military occupational specialty. The disclosure came in the same news cycle as a Delta flight’s smoke emergency.

The Pentagon is not the only government agency dealing with a data security incident. The FBI is managing a separate breach of its jobs portal, FBIJobs.gov, after the hacking group ShinyHunters claimed it would release data including home addresses, contact information, and Social Security numbers of FBI employees.

The bureau has been operating as if every employee’s personal information was compromised. However, in a statement to The New York Times and 404 Media on Monday, the group claimed it would not release the data after all, describing the episode as “all a marketing campaign.” ABC News has not independently verified the group’s claims.

The FBI has begun notifying impacted employees and holding internal briefings, advising them to maintain situational awareness and avoid answering suspicious calls. It also reportedly warned employees not to speak with the media and to call 911 if media representatives are trespassing.