INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Pentagon Personnel Records Exposed in Massive Data Breach Incident

| 2026-09-29 12:25 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
The Pentagon's Defense Manpower Data Center (DMDC) has been breached, exposing the sensitive data of millions of military service members. The breach occurred in October 2025 and was exploited by hackers who gained unauthorized access to the DMDC's human resources management system. As a result, over 3 million people, including nearly 2.8 million living individuals and 294,000 deceased individuals, have been affected. The data stolen includes personally identifiable information (PII), which may include Social Security numbers and other sensitive details. In response to the breach, the Pentagon is offering 12 months of free credit monitoring services through a third-party provider and urging affected individuals to enroll by August 19, 2027. This incident highlights the vulnerability of government agencies to cyber threats and underscores the importance of robust cybersecurity measures to protect sensitive information.
Technical Mitigations AI-generated
• Implementing a robust vulnerability management program to identify and address security vulnerabilities in file-sharing systems before they can be exploited. • Conducting regular penetration testing and security assessments on the DMDC system to enhance its cybersecurity posture and detect potential weaknesses. • Utilizing multi-factor authentication (MFA) for access control, ensuring that only authorized personnel have access to sensitive data, including personally identifiable information (PII).
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
fb•••••.gov
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA defensedefense governmentgovernment
Incident Timeline
‎as of fiscal year 2024
DMDC held at least 60 million personnel records, which were exposed in a massive data breach incident as of fiscal year 2024.
data_breach 60 records
According to its website, DMDC held at least 60 million records as of fiscal year 2024.
‎fiscal year 2024
Threat actors accessed at least 60 million personnel records of the Defense Manpower Data Center (DMDC) in fiscal year 2024.
data_breach 60 records
DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans.
‎October 2025
Hackers exploited a vulnerability in the Pentagon's human resources management system to steal sensitive data, including personally identifiable information (PII), from millions of military service members.
organisation PII
“Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII,” the letter says.
In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems.
“Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII.
industry Defense
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025.
organisation DMDC
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025.
organisation Defense Manpower Data Center (
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025.
tactic Data Breach
In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems.
‎July 2026
Threat actors exploited a vulnerability in the DMDC's file-sharing systems to gain unauthorized access to sensitive personally identifiable information (PII) of Pentagon personnel between October 2025 and July 2026.
tactic Data Breach
In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems.
organisation PII
In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems.
‎July 16, 2026
A security vulnerability in a DMDC file sharing system was discovered on July 16, 2026, allowing unauthorized users to access Pentagon personnel records.
target_region United States
The vulnerability was discovered on July 16, 2026, and the US office quickly patched the system and restored it.
‎September 18
A notification letter dated September 18 was shared online by a recipient, revealing that the Pentagon personnel records breach occurred in mid-July.
‎September 29, 2026
Threat actors accessed a file-sharing server for approximately nine months, exposing the sensitive data of three million Pentagon personnel.
organisation Pentagon
Three Million Affected in Pentagon Personnel Agency Data Breach Pierluigi Paganini September 29, 2026 Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months.
tactic Data Breach
Three Million Affected in Pentagon Personnel Agency Data Breach Pierluigi Paganini September 29, 2026 Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months.
general_metric 3 People
Three Million Affected in Pentagon Personnel Agency Data Breach Pierluigi Paganini September 29, 2026 Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months.
‎2026/09/29
Threat actors, claiming to be ShinyHunters, stole over 3 million Pentagon personnel records, including Social Security numbers and other personal identifiable information.
organisation The US Defense Manpower Data Center
The US Defense Manpower Data Center (DMDC), which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed.
organisation DMDC
The US Defense Manpower Data Center (DMDC), which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed.
The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach.
organisation Pentagon
The US Defense Manpower Data Center (DMDC), which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed.
Hackers stole Pentagon personnel records of over 3 million people.
organisation SSN
The types of PII involved vary by individual; however, in your case, they include social security number (SSN) and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information (such as occupational specialty).” US Defense Manpower Data Center (DMDC) notice of data breach ( Source Reddit )
organisation US Defense Manpower Data Center (
The types of PII involved vary by individual; however, in your case, they include social security number (SSN) and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information (such as occupational specialty).” US Defense Manpower Data Center (DMDC) notice of data breach ( Source Reddit )
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking,  US Defense Manpower Data Center )
organisation US Defense Manpower Data Center
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking,  US Defense Manpower Data Center )
organisation the U.S. Department of Defense
Founded in 1974, the DMDC is an operational support center that stores more than 60 million military, civilian, contractor, family member, retiree, and veteran records used to authorize benefits and entitlements, as well as training, financial, and other data for the U.S. Department of Defense (DoD).
organisation DoD
It also operates DoD personnel programs and conducts research and analysis as directed by the Office of the Secretary of Defense (OUSD).
organisation the Office of the Secretary of
It also operates DoD personnel programs and conducts research and analysis as directed by the Office of the Secretary of Defense (OUSD).
organisation Defense (OUSD
It also operates DoD personnel programs and conducts research and analysis as directed by the Office of the Secretary of Defense (OUSD).
organisation The U.S. Defense Manpower Data Center (
The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach.
organisation the Department of Defense
The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach.
organisation CNN
“The Pentagon has confirmed that the breach affects 2.76 million “living individuals,” a category that potentially includes current and former defense personnel or their dependents, and 294,000 “deceased individuals,” a Defense Department official told CNN on Monday, three days after this story was published.”
A Department of War official told CNN that the breach impacts 2.76 million living individuals and 294,000 deceased individuals.
organisation Defense Department
“The Pentagon has confirmed that the breach affects 2.76 million “living individuals,” a category that potentially includes current and former defense personnel or their dependents, and 294,000 “deceased individuals,” a Defense Department official told CNN on Monday, three days after this story was published.”
organisation The Defense Manpower Data Center (
The Defense Manpower Data Center (DMDC) has notified individuals that a security vulnerability exposed personal information stored on one of its file-sharing systems.
organisation Pentagon Personnel Agency Data Breach
Pentagon Personnel Agency Data Breach Impacts 3 Million People.
Three Million Affected in Pentagon Personnel Agency Data Breach.
organisation Federal News Network
Pentagon officials told Federal News Network that the data breach affects more than 3 million people, including nearly 2.8 million living individuals and 294,000 "deceased individuals.
threat_actor ShinyHunters
This incident follows another massive data breach claimed by the ShinyHunters extortion gang , who breached the FBI's FBIjobs.gov site using an Oracle PeopleSoft zero-day.
ShinyHunters claimed to have stolen several terabytes of data (including names, Social Security numbers, home addresses, and assignments) belonging to "almost ALL FBI Agents," including employee records belonging to members of the FBI Remote Operations Unit , a team involved in hacking operations.
ShinyHunters told BleepingComputer that the FBI breach was not financially motivated and that the group doesn't intend to publish the stolen data or extort the bureau.
organisation IDX
DMDC is also offering 12 months of free credit monitoring through IDX, a company specializing in data breach and recovery services.
organisation Social Security
Exposed records varied by individual and included Social Security numbers alongside names, dates of birth, contact details, demographic data, and military occupational specialties.
The stolen data varies by person and includes Social Security numbers (SSNs), names, dates of birth, contact information, sex, race, and military personnel information.
The data exposed varies by person, but in this case included Social Security numbers (SSNs) and at least one other identifier, such as name, date of birth, contact details, sex, race or military personnel information, including occupational specialty.
organisation DoW
“At this time, DoW does not have any indications of misuse of the accessed information,” DMDC says.
organisation Department of War
A Department of War official told CNN that the breach impacts 2.76 million living individuals and 294,000 deceased individuals.
The breach affects 2.76 million living people and 294,000 deceased individuals, according to a Department of War official.
organisation Office of Management and Budget and Department
" "Upon discovery of the security vulnerability, DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of Management and Budget and Department guidelines and policies," the DMDC told affected individuals.
organisation BleepingComputer
A Pentagon spokesperson was not immediately available to comment when BleepingComputer reached out for more information about the breach.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
‎August 19, 2027
IDX, a data breach and recovery service provider, offered 12 months of free credit monitoring services to affected Pentagon personnel.
tactic Data Breach
" The Pentagon is also offering 12 months of free credit monitoring services through the IDX data breach and recovery service provider and says affected individuals must enroll by August 19, 2027.
organisation IDX
" The Pentagon is also offering 12 months of free credit monitoring services through the IDX data breach and recovery service provider and says affected individuals must enroll by August 19, 2027.
Tactical Metrics
Metrics
data_breach
60,000,000
Records
According to its website, DMDC held at least 60 million records as of fiscal year 2024.
DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans.
Intelligence Sources
SecurityWeek 2026-09-29
Security Affairs 2026-09-29
BleepingComputer 2026-10-01