WASHINGTON — September 30, 2026: A breach of a Pentagon personnel database exposed sensitive information belonging to 2.76 million living people and 294,000 deceased individuals, according to Defense Department officials cited by multiple news organizations.
The affected system is operated by the Defense Manpower Data Center, or DMDC, which maintains records connected to service members, civilian employees, retirees, veterans, contractors and military families. Officials said unauthorized users accessed unencrypted files containing Social Security numbers and military or civilian employment information between October 2025 and July 16, 2026.
What the Pentagon says happened
The Defense Department discovered the vulnerability on July 16 and closed the access point, according to accounts based on the department’s notification letter and statements from Pentagon officials. Notices to affected individuals began going out on September 18.
The Pentagon said it had not found evidence that the exposed information had been misused. That statement is important, but it does not mean misuse is impossible: it describes what investigators had identified at the time of the announcement.
Fox News reported the confirmed totals on September 30. ABC News and Federal News Network had separately reported the same figures earlier in the week after receiving confirmation from Defense Department officials. Military Times also reviewed a breach-notification letter and reported that the exposed information was stored on a server in unencrypted form.
Why the DMDC system matters
DMDC is one of the Defense Department’s principal personnel-data repositories. Its records help verify military affiliation and benefits eligibility across a large population that can include active-duty and reserve personnel, civilian workers, contractors, retirees, veterans and dependents.
That makes the incident materially different from the compromise of a small office directory. Social Security numbers paired with employment details can support identity fraud, targeted phishing or attempts to impersonate government personnel. The public reporting does not establish that any of those harms occurred in this case.
Timeline of the exposure
- October 2025: The period of unauthorized access began, according to the Pentagon’s account.
- July 16, 2026: DMDC discovered and remediated the vulnerable file-sharing system.
- September 18, 2026: The department began notifying affected people.
- September 28–30, 2026: News organizations published the confirmed totals and additional details.
The roughly nine-month access window is likely to be a central question in any review of the incident. Public reporting has not yet identified the unauthorized users, explained how they obtained access or specified whether every exposed record contained the same fields.
What remains unknown
The Defense Department has not publicly identified an attacker or attributed the breach to a criminal group or foreign government. It also has not released a public forensic report explaining how many files were opened, copied or downloaded.
Those gaps matter because “access” and confirmed theft are not necessarily the same thing. AskNovus will distinguish any later investigative findings from the facts the Pentagon has confirmed so far.
People who receive an official breach notice should use the instructions and contact information in that notice rather than responding to unsolicited calls, texts or emails. The Federal Trade Commission’s IdentityTheft.gov portal also provides general identity-theft reporting and recovery guidance.
Broader cybersecurity context
The incident adds to recent scrutiny of sensitive federal systems. It is separate from the reported compromise of the FBI’s employment website and from financially motivated attacks such as the alleged ATM-malware network recently covered by AskNovus.
Follow verified government and security developments in Technology News and U.S. News.
Sources
- Fox News, September 30, 2026: Pentagon confirmation and breach timeline
- ABC News, September 28, 2026: affected population and DMDC context
- Federal News Network, September 28, 2026: Defense Department statement
Featured image: imgix/Unsplash. Illustrative photograph.