Pentagon gets pwned as breach exposes sensitive data on nearly three million military and civilian personnel

The U.S. Department of Defense’s Defense Manpower Data Center (DMDC) experienced a data breach between October 2025 and July 2026, allowing unauthorized users to access and potentially exfiltrate data on 2.76 million records relating to living personnel, and an additional 294,000 records relating to deceased individuals. According to ABC News, some of the exposed information included Social Security numbers and the job details of both military and civilian personnel.

“A Defense Manpower Data Center information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. Upon discovery, DMDC immediately remediated the vulnerability,” a U.S. defense official said in a statement. However, they also added that there hasn’t been any evidence of misuse of the compromised data at this time.

DMDC serves as the Pentagon’s central personnel database, storing information on active-duty and reserve members of the military, as well as civilian employees, contractors, retirees, veterans, and even military family members, and holds over 60 million records in its care. This makes any breach of its system potentially significant, putting the privacy and personal security of those affected at risk. But because the repository also lists the roles and job details of the affected personnel, it could also reveal the identities of people assigned to sensitive positions related to national security.

While it might be good news that there haven’t been any signs that the exposed information has been exploited, it could also mean that whoever was behind the breach is just sitting on the data for later use. The Pentagon also did not mention who was behind the hack, nor did it mention how it discovered the vulnerability.

Given that most governments rely on digital infrastructure for their day-to-day operations, one can expect that their adversaries, and sometimes even their allies, are always probing and looking for vulnerabilities in their systems. Chinese hackers reportedly breached the U.S. Treasury Department in early 2025, even going as far as hacking the Treasury Secretary’s PC. More recently, the CanisterWorm malware has spread and wiped Iranian machines for no reason, while the Middle Eastern country also claimed that Western-made routers from Cisco and others failed just as the U.S. and Israel began their bombing campaign against it during the first quarter of this year. At the same time, U.S. authorities released a warning that Iranian hackers are targeting Siemens controllers in a bid to sabotage critical infrastructure.

Even though the Pentagon claims it has already fixed the issue and stopped further information from leaking through this vulnerability, it cannot change exposed information like Social Security numbers and employment histories. This means that the affected people would need to remain more vigilant against criminals, intelligence services, and other threat actors long after this incident fades from the news cycle. And if an affected individual is in a sensitive position relating to national security, it's going to take more than a year of free credit monitoring to keep them safe.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.