An intrusion in the Pentagon’s human resources information system remained undetected for about 9 months, exposing the personal data of more than 3 million people to unauthorized access. The system is run by the Defense Manpower Data Center (DMDC); an organization that manages information related to a large portion of the military forces and civilian employees of the Department of Defense.
According to Etnamaq citing TechSpot, the U.S. Department of Defense said the incident affected 2.76 million living individuals and about 294,000 deceased individuals. The DMDC database contains more than 60 million records in total and holds data on active-duty forces, reserve forces, civilian employees, contractors, retirees, veterans, and military family members.
The unauthorized access continued from October 2025 to July 2026, and after discovery, the Pentagon patched the vulnerability. However, defense officials have not yet released key details about the attack. It is unclear how the attackers entered the system, what vulnerability they exploited, how much information they viewed or copied, and why their activity went undetected for about 9 months. No individual or country has been identified as responsible for the intrusion.
The sensitivity of this breach is not limited to the number of victims. The combination of Social Security numbers with job and location information can create risks beyond ordinary identity theft. Moreover, Social Security numbers and other permanent identifiers cannot be changed as easily as a password; therefore the consequences of a data leak may persist long after the vulnerability is fixed.
Defense officials say they have found no evidence so far of misuse of the stolen information and are offering identity protection and credit monitoring services to affected individuals. However, the absence of evidence of misuse does not eliminate the risk; stolen information can be stored, traded, or combined with other data.
This incident occurred shortly after the disclosure of a separate breach on the FBI’s recruitment website (FBIJobs.gov). For the Pentagon, patching the vulnerability is only the first step, and now determining the real scope of the 9-month access and whether information was copied or used elsewhere is of greater importance.