Notification letters are reaching current and former US military personnel. They say unauthorized users spent months inside a Defense Manpower Data Center (DMDC) system that held unencrypted Social Security numbers.
The Pentagon has said little else. Several details remain unclear, including the number of people affected.
What the notices say
According to TechCrunch, which cited a notice shared on Reddit, several unauthorized users exploited a vulnerability in an unspecified file-sharing system. The activity ran from October 2025 to mid-July 2026.
The exposed information included Social Security numbers, names, dates of birth, sex, race and other military service details.
The notice says the records were not encrypted.
Military Times reviewed a notification letter and confirmed that it was authentic. Per that reporting, carried by Yahoo, DMDC found the vulnerability on 16 July. The letter was sent on 18 September to a person whose data was in the affected files.
DMDC is one of the Defense Department’s records units.
TechCrunch reports it keeps more than 60 million records on military and civilian staff and their families.
Those records help determine benefits such as healthcare and retirement.
How many people?
The figures do not match. Military Times said roughly four million Defense Department personnel may be affected. FEDweek, citing a War Department official, reported something different. It said the breach touched 2.76 million living people and about 294,000 deceased people, or roughly 3.05 million in total. FEDweek also said notices were going to about 2.7 million current and former military-affiliated individuals.
It is not clear from the sources why the counts differ. They may reflect different counting methods or different stages of the investigation.
What the Pentagon has and hasn’t said
The official told FEDweek that a “small number of unauthorized users” accessed the files. The official said the flaw was fixed once it was found. The department has “no indications of misuse” of the data so far.
FEDweek also reported that the Pentagon is giving few details on who the intruders were or how they got in. It has not said whether the breach is linked to a separate review of identity-verification records tied to Common Access Cards. Military Times reported that the department is offering affected people one year of credit monitoring and identity-restoration services.
Note the gap between discovery and notice. The flaw was found in mid-July. At least one letter was dated 18 September, about two months later.
What affected people can do
Nothing in the sources suggests the data has been misused. Even so, a stolen Social Security number stays useful to criminals for years, so a one-year monitoring offer may not be enough. Sensible steps include:
- Accept the free monitoring if you receive a notice, using the enrolment instructions in the letter itself rather than a link in an unexpected email or text.
- Freeze your credit with the three major bureaus. It is free and stops most new accounts from being opened in your name.
- Get an IRS Identity Protection PIN to make it harder for someone to file a fraudulent tax return.
- Check your credit reports at AnnualCreditReport.com and look for accounts or inquiries you don’t recognise.
- Treat unsolicited contact with suspicion. Scammers often use breach news to pose as the Pentagon, a bank or a monitoring company. Don’t give out your Social Security number to someone who contacts you first.
- Tell family members. Spouses, dependents and retirees are among the groups whose records DMDC holds.
If you have not received a letter but served, worked for the Defense Department or were a dependent, a credit freeze costs nothing and is worth doing anyway. Given the long exposure window and the unanswered questions, more details may emerge as notices reach more people.