Pentagon data breach exposes records of over 3M people

You can change a password after a breach. You can cancel a credit card. But when your Social Security number gets exposed, you could be dealing with the fallout for years. That is the concern after a involving the Pentagon's Defense Manpower Data Center. If you have served in the military, worked for the Department of War or have other ties to the military community, your information could be among the records involved.

A official told CyberGuy that 2.76 million living individuals and 294,000 deceased individuals were affected. Depending on the person, the exposed information can include Social Security numbers, names, dates of birth, contact information and military personnel details. So, if a breach letter from the Pentagon shows up in your mailbox, don't toss it aside. Here's what happened, what may have been exposed and what you can do to protect yourself.

DMV BREACH CONFIRMED AS HACKERS CLAIM 200,000 RECORDS STOLEN

Join us for a free CyberGuy LIVE class.

Kurt "CyberGuy" Knutsson shares practical ways to stay safer, smarter and more confident with technology. Explore classes on stopping spam, phone security, financial protection and using AI to get better healthcare. Each class is free, easy to follow and comes with a free printable checklist.

See the classes and register at CyberGuyLive.com

The breach involved the Defense Manpower Data Center, or DMDC. A War Department official told CyberGuy that a DMDC information system experienced unauthorized access to personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. The official said DMDC immediately remediated the vulnerability after discovering it. At this time, the department says it has no indication that the accessed information has been misused.

The files accessed contained unencrypted personally identifiable information. That created a potentially long exposure window before the vulnerability was discovered. Personal information such as a Social Security number can remain useful to criminals long after the original breach fades from the headlines.

The specific information varies depending on the person. According to the Pentagon, exposed records can include:

The military details make this breach particularly sensitive because the records may reveal more than basic identity information. DMDC plays a major role behind the scenes at the Department of Defense. It maintains more than 60 million records covering military personnel, civilian employees, contractors, family members, . The agency uses those records to support benefits, identity verification and other Defense Department programs. In other words, plenty of people who left active military service years ago may still have information stored in these systems.

People whose personal information was accessed are being notified by postal mail through the Department's contracted provider, Identity Theft Guard Solutions, or IDX. If you receive a notice, read it carefully rather than assuming it is another piece of junk mail. The letter should explain what information tied to you was affected and what protection is being offered.

According to the War Department official, IDX is providing notification, credit monitoring and identity restoration support based on the data elements affected for each individual. Anyone with questions can visit response.idx.us/DMDC or call 1-855-744-4556.

Be careful with unexpected emails or text messages claiming to be connected to the breach. Scammers can use major security incidents as an excuse to send fake notices or links designed to steal even more information. Instead of clicking a link in an unexpected message, verify the information usi