The US Defense Manpower Data Center (DMDC), which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed.
According to the DMDC’s notice, unauthorized users had access to one of its file-sharing servers for roughly nine months.
A copy of the notification letter, dated September 18 and shared online by a recipient, says the problem was discovered in mid-July.
“On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored,” the letter reads.
The letter does not name the affected file-sharing product or describe the vulnerability.
“Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII,” the letter says.
Exposed records varied by individual and included Social Security numbers alongside names, dates of birth, contact details, demographic data, and military occupational specialties.
“At this time, DoW does not have any indications of misuse of the accessed information,” DMDC says.
The letter does not say how many people are affected. A Department of War official told CNN that the breach impacts 2.76 million living individuals and 294,000 deceased individuals.
According to its website, DMDC held at least 60 million records as of fiscal year 2024. Those records cover military and civilian personnel, contractors, family members, retirees and veterans.
It is unclear who is behind the cyberattack. No known cybercrime group appears to have taken credit for an attack on the DMDC.
DMDC says it launched privacy and cybersecurity incident response actions after finding the vulnerability.
Related: DC Health Agency Exposes 400,000 Beneficiary Records
Related: Astrana Health Data Breach Impacts Private, Confidential Information
Related: ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report
