The Defense Manpower Data Center, the Pentagon agency that holds personnel records for the U.S. military, has disclosed a breach affecting about 3 million people, SecurityWeek reported Tuesday. An unauthorized party exploited a weakness in one of the agency's file-sharing systems and had access for roughly nine months.

What Happened

According to the agency's notification, the incident affects 2.76 million living individuals and 294,000 who have died. The exposed information includes Social Security numbers, names, dates of birth, contact details, demographic data and military occupational specialties.

The DMDC said a vulnerability in a file-sharing system allowed unauthorized users to reach personally identifiable information that was stored unencrypted on a server. Access ran from October 2025 until mid-July 2026. The agency discovered the problem on July 16, patched the vulnerability, restored the system and started privacy and cybersecurity incident response work. The notification letter reported by SecurityWeek is dated Sept. 18, about two months after discovery.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The agency did not name the file-sharing product or describe the vulnerability. SecurityWeek noted that no known cybercrime group appears to have claimed responsibility, and the department said it currently has no indication that the accessed data has been misused.

Why It Matters

The DMDC is a central store of information on service members, and the combination of data in this breach is the kind used for identity fraud and targeted phishing. Social Security numbers cannot be changed the way a password can, so the exposure lasts well beyond the incident itself. Military occupational specialty data adds another layer: it shows what a person did in uniform, which can help someone pick out people with specialized or sensitive roles.

The nine-month gap between first access and detection is also significant. An intruder with that much time on a file-sharing server could have copied data gradually, and the agency has not said how much was actually taken as opposed to exposed. The fact that the records were stored unencrypted meant that access to the server was enough to read them.

The inclusion of nearly 300,000 deceased people is a reminder that personnel archives keep records long after service ends. Identities of the dead are a known target for fraud because misuse can go unnoticed by relatives for some time.

A Familiar Entry Point

File-sharing and managed file transfer software has been a repeated route into large data stores. The 2023 mass exploitation of Progress Software's MOVEit Transfer, carried out by the Clop extortion group, hit government agencies and companies worldwide, and similar products have been targeted since. There is no public indication that this incident is connected to any of those campaigns, and without a named product, other organizations running similar software have nothing specific to check.

The breach also invites comparison with the 2015 Office of Personnel Management hack, which exposed background investigation records on more than 21 million people and remains the benchmark for federal personnel data losses.

What to Watch

Key open questions are which file-sharing product was involved, whether the flaw was a publicly known vulnerability or a zero-day, and who was behind the access. Affected individuals are being notified by letter. Whether the department offers credit monitoring or identity protection, and whether the data surfaces on criminal marketplaces, will shape how serious the fallout becomes.