Pentagon breach exposed sensitive data on nearly 3 million people

Pentagon personnel database breach exposed data tied to nearly 3 million people

Cyberzenhub.com – A security breach involving a major Pentagon personnel system exposed sensitive records connected to millions of people in the military community, including Social Security numbers and information about positions held by military and civilian workers.

The incident affected 2.76 million living individuals and approximately 294,000 deceased people, a U.S. defense official said. Because the files included employment-related details in addition to personal identifiers, the exposure could create concerns beyond ordinary identity theft, particularly for people whose work assignments may carry operational or security significance.

The compromised system was operated by the Defense Manpower Data Center, known as DMDC. The organization is one of the Defense Department’s central repositories for personnel information and holds records involving active-duty service members, reservists, civilian employees, contractors, retirees, veterans and military family members. Its broader collection includes more than 60 million personnel records.

Unauthorized access lasted months

The unauthorized access began in October 2025 and continued until July 2026, when the vulnerability was identified and the affected system was patched. Defense officials said the issue was addressed immediately after discovery.

“A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. Upon discovery, DMDC immediately remediated the vulnerability,” the official said.

Officials have not found evidence that the exposed information has been used improperly so far. People affected by the breach are being offered identity-protection and credit-monitoring resources, measures intended to help them detect suspicious activity involving their personal data.

For those whose information may have been included, the risk can extend well beyond a single unauthorized transaction. Social Security numbers, dates of birth, contact details and employment records can be valuable to criminals attempting identity fraud or targeted phishing. Job information may also give bad actors additional context for convincing impersonation attempts, such as messages that appear to come from a workplace, government office or benefits provider.

Why the personnel system matters

DMDC supports a broad cross-section of the Defense Department’s workforce and affiliated community. The scale of its records means that a breach of even one system can affect current employees, former personnel and family members whose information has been retained for administrative, benefits or service-related purposes.

The incident also illustrates why cybersecurity events at large government institutions can have lasting consequences. A vulnerability may be corrected quickly once found, but the information accessed during the exposure period cannot necessarily be retrieved or controlled. Credit monitoring can help flag new accounts or unusual credit activity, while continued caution with unexpected calls, emails and text messages can reduce the likelihood of further exploitation.

Defense officials have not publicly identified misuse of the exposed Pentagon data. Still, people who receive notification of an impact may want to review their credit reports, watch for unfamiliar financial activity and be wary of requests for personal details, passwords or verification codes. Government agencies generally do not need recipients to disclose sensitive credentials through unsolicited communications.

FBI employees also warned after jobs portal incident

The Pentagon disclosure came as the FBI responded to a separate breach involving its employment website, FBIJobs.gov. The bureau sent a notice to employees Friday describing its response to the incident involving the jobs portal, which was an unclassified system.

A threat actor said it would release information that could include FBI employees’ names, home addresses, personal and work contact details, Social Security numbers, birth dates and emergency-contact information. The bureau is treating the situation as though every employee’s personal information may have been compromised.

Employees affected by the FBIJobs.gov incident have begun receiving notifications. The FBI also advised personnel to remain alert, avoid responding to suspicious calls and take part in internal briefings intended for impacted employees.

The bureau’s warning further instructed employees not to speak with the media. In situations involving trespassing, personnel were told to call 911.

Growing importance of personal-data protection

Both incidents underscore the value of personal data held in large government systems. Information that may seem routine in isolation—such as a name, address, work role or date of birth—can become far more sensitive when combined with other records. That combination can enable fraud, harassment or highly tailored social-engineering attempts.

For service members, civilian staff and other individuals connected to federal institutions, security awareness remains important even when there is no known misuse of data. Unsolicited outreach that creates urgency, asks for confidential information or directs a person to an unfamiliar website should be treated carefully. Verifying requests through established contact channels can help prevent an initial data exposure from turning into a more serious personal security problem.