← Defense Manpower Data Center (DMDC)

2026 DoD DMDC — file-share vuln; SSNs accessed Oct 2025–Jul 16; ~4M may be affected

2026 4.0M records affected Share on X

Data compromised

Per notification letters reviewed by Military Times/CNN (authenticity confirmed by defense officials): Social Security numbers plus at least one additional identifier such as name, DOB, contact info, sex, race, or military occupational specialty. Unauthorized access window October 2025–July 16, 2026. DoD says no indication of misuse for notified individuals; offering 1 year IDX credit monitoring. Official department-wide census unpublished; ~4 million DoD personnel may be affected per sources familiar cited by Military Times.

Technical writeup

Verified DoD/DMDC individual breach-notification letters (sent ~Sep 18, 2026) as reported by Military Times (Natalie Oliverio) and CNN — authenticity confirmed by defense officials. DMDC discovered a vulnerability in a file-sharing system on July 16, 2026; forensic analysis found unauthorized users accessed a server holding unencrypted PII between October 2025 and July 16, 2026. Letters state SSNs plus additional identifiers (name/DOB/contact/sex/race/military occupational specialty). DMDC patched and restored the system. DoD states no indication of misuse for notified individuals; offers one year IDX monitoring/identity restoration. Official published headcount not released; Military Times cited two people familiar estimating approximately four million Defense Department personnel may be affected — used as best available press estimate (not an official DoD census). Counterintelligence concerns raised in CNN coverage because occupational specialty data can highlight sensitive work areas. recordsAffected 4000000 (approximate press estimate); companyConfirmed true.

Root cause

Security vulnerability in a DMDC file-sharing system allowed unauthorized users to access unencrypted personnel PII (DoD breach notification letters)

References

Breaches you may like