A US defence official said the incident affected 2.76 million living individuals and about 294,000 deceased people, establishing a clearer scale for an intrusion that exposed Social Security numbers and personnel information held by the department.
The Defense Manpower Data Center, or DMDC, said a small number of unauthorised users gained access to personally identifiable information between October 2025 and July 2026. The compromised files were stored on a vulnerable file-sharing server and contained unencrypted data.
The centre discovered the vulnerability on July 16 and subsequently determined that unauthorised users had accessed files during the preceding nine months. It patched the vulnerability and restored the affected system after identifying the problem.
Information exposed varied by individual. Notification material sent to affected people said compromised records included Social Security numbers together with at least one additional identifying detail. Those details could include names, dates of birth, contact information, sex, race and military personnel information, including occupational specialty.
The inclusion of occupational information has added a national-security dimension to an incident that would otherwise carry the familiar risks associated with identity theft. Detailed personnel records can potentially reveal where people work, the functions they perform and other information useful for targeting military or civilian personnel.
The Pentagon has not publicly identified the unauthorised users or disclosed their motive. It has also not announced evidence establishing that the exposed information has been used for fraud or other malicious activity. DMDC told affected individuals that it had no indication their information had been misused.
The confirmed count also narrows earlier uncertainty surrounding the scope of the incident. Initial notifications did not provide a total number of affected people, while estimates circulating after the breach became public suggested that the potential population could be larger. The Pentagon’s latest figures identify just over 3.05 million living and deceased individuals as affected.
DMDC began notifying affected people this month. A notification dated September 18 described the vulnerability, the period of unauthorised access and the types of personal information that could have been exposed.
Those receiving notices have been offered one year of credit monitoring and identity-restoration services. Such protection is intended to help detect attempts to open accounts or otherwise misuse personal identifiers, although the long-term sensitivity of Social Security numbers means exposure can remain relevant after monitoring services expire.
The breach has drawn particular attention because DMDC sits at the centre of the US Defense Department’s personnel-data infrastructure. Its systems maintain information used for manpower analysis, personnel and readiness operations, benefits eligibility and other administrative functions involving service members, civilian personnel, retirees and eligible dependants.
A federal privacy notice published this year describes the underlying human-resources records system as supporting personnel and readiness operations, manpower analysis, fraud detection involving pay and benefits, and registration of eligible individuals and dependants for medical treatment and other benefits. The breadth of those functions illustrates the sensitivity of information handled by the centre.
Publicly available information has not established whether the attackers downloaded every file they accessed, how the vulnerability was first exploited or whether the intrusion was linked to a criminal group or foreign intelligence service. The Pentagon has therefore stopped short of assigning responsibility.
The incident also leaves questions over why personally identifiable information on the affected server was unencrypted and why the unauthorised access persisted for months before discovery. The breach notification confirms the exposure window but does not provide a detailed account of the security controls that failed or the method used to detect the intrusion.
DMDC’s public security notice says its government systems use software to monitor network traffic for unauthorised attempts to alter information or cause damage. The centre has not publicly detailed whether those monitoring measures generated warnings during the period in which the file-sharing server was being accessed.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
