A Pentagon records office left the Social Security numbers of nearly 3 million people open to outsiders for about nine months, and the list reaches far past active troops. Defense officials put the scale at about 2.76 million living people on Monday, September 28, and said the files cover service members, civilian workers, contractors, retirees, veterans and military families. The cause was a weak spot in the agency’s file-sharing system that let “a small number of unauthorized users” reach the records from October 2025 until it was found and patched in July 2026.
Story Snapshot
- About 2.76 million living people and 294,000 people who have died had personal data exposed.
- The records included Social Security numbers, names, birth dates, contact details and military job codes, stored without encryption.
- The Defense Manpower Data Center found the flaw on July 16, 2026, and patched it.
- Notice letters offer a year of free credit monitoring and identity-restoration help.
Who Is in the File and How It Happened
The Defense Manpower Data Center keeps personnel records for the Defense Department. Its official statement said the system “experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026.” The weak spot was in a file-sharing system. The agency found it on July 16, 2026. Officials said the agency “immediately remediated the vulnerability,” patching the file-sharing system and restoring it.
Officials said the files belong to active-duty and reserve troops, civilian employees, contractors, retirees, veterans and family members. What was exposed varies by person. The records can include Social Security numbers, names, dates of birth, contact details, demographic data and military job codes. The data was not encrypted. Officials have not named who got in, and no criminal group has claimed it. Defense officials said they have found no sign so far that the data has been misused.
Why This Kind of Data Matters
A Social Security number cannot be changed like a password. Paired with a name, birth date and address, it can be used to open credit in someone else’s name or to build a convincing scam call or email. Job details add more. A crook who knows a person’s military role can pose as a unit, a benefits office or a pay office. That is why personnel files draw so much interest from criminals and foreign spies.
The government has been through this before. The Office of Personnel Management breach disclosed in 2015 affected more than 21 million people and showed that personnel files are a prime target. Those files hold details that follow a person for life. The Pentagon breach fits the same pattern: one large store of identity data, open to outsiders for months.
What To Do Before A Crook Finds Your Name
If you or anyone in your family ever served, worked for the military or was married to someone who did, these steps cost nothing and take a few minutes:
- Freeze your credit. It is free at the three major bureaus, Equifax, Experian and TransUnion. A freeze blocks anyone from opening new credit in your name until you lift it.
- Watch your mail for the letter. The Defense Manpower Data Center’s notice letters, dated September 18, offer a year of free credit monitoring and identity-restoration help through IDX, a private firm working for the department. Active-duty troops and National Guard members also have free electronic credit monitoring.
- Check your statements. Look over bank and credit card statements for charges or accounts you do not recognize, including for family members who have died.
- Be wary of calls that know too much. A caller, text or email that uses your service details, unit or job can sound official. Hang up and call the office back at a number you find yourself.
For families who never expected their records to be a target, the letter from the Defense Manpower Data Center is the one to open and keep.
Sources:
abcnews.com, securityweek.com, time.com, militarytimes.com, cnn.com, fakti.bg, military.com, hromadske.ua, en.apa.az