2026 DoD DMDC — file-share vuln Oct 2025–Jul 16; ~2.76M living + 294k deceased
Data compromised
Varies by person: SSNs, names, DOB, contact info, sex, race, and military personnel information (DMDC letters via BC Oct 1); DoW/Pentagon count ~2.8M living + ~294k deceased (~3.05M+)
Technical writeup
Verified DoD/DMDC individual breach-notification letters (sent ~Sep 18, 2026) as reported by Military Times (Natalie Oliverio) and CNN — authenticity confirmed by defense officials. DMDC discovered a vulnerability in a file-sharing system on July 16, 2026; forensic analysis found unauthorized users accessed a server holding unencrypted PII between October 2025 and July 16, 2026. Letters state SSNs plus additional identifiers (name/DOB/contact/sex/race/military occupational specialty). DMDC patched and restored the system. DoD states no indication of misuse for notified individuals; offers one year IDX monitoring/identity restoration. Official published headcount not released; Military Times cited two people familiar estimating approximately four million Defense Department personnel may be affected — used as best available press estimate (not an official DoD census). Counterintelligence concerns raised in CNN coverage because occupational specialty data can highlight sensitive work areas. recordsAffected 4000000 (approximate press estimate); companyConfirmed true. Updated Oct 1, 2026: recordsAffected set to 3054000 per DoW official living/deceased split reported by CNN/TIME and SecurityWeek.
Root cause
Security vulnerability in a DMDC file-sharing system allowed unauthorized users to access unencrypted personnel PII (DoD breach notification letters)
References
- https://www.militarytimes.com/news/pentagon-congress/2026/09/24/military-personnel-data-exposed-in-breach-agency-warns/
- https://www.cnn.com/2026/09/25/politics/pentagon-data-personnel-breach
- https://databreaches.net/2026/09/26/pentagon-data-breach-of-military-personnel-raises-national-security-concerns/
- https://www.securityweek.com/pentagon-personnel-agency-data-breach-impacts-3-million-people/
- https://time.com/article/2026/09/29/pentagon-department-defense-manpower-data-center-breach-personnel/
- https://www.bleepingcomputer.com/news/security/hackers-breach-pentagon-human-resources-management-system-steal-data-of-nearly-3-million-people/
- https://federalnewsnetwork.com/defense-main/2026/09/more-than-3-million-people-affected-by-military-data-breach/