Hackers steal personal records of millions of US military personnel

The US government has begun notifying millions of current and former service members that their personal information was stolen in a breach of the Pentagon's personnel records that lasted several months. It is only the latest in a string of thefts affecting federal workers' data in recent months.

According to a breach notification from the Defense Manpower Data Center (DMDC), shared on Reddit, several unauthorized users exploited a vulnerability in an unspecified file-sharing system. Their access persisted from October 2025 through mid-July 2026.

What was exposed

The attackers obtained personally identifiable information: Social Security numbers, names, dates of birth, sex, race, and details of military service. The notice specifically points out that the records were stored unencrypted.

According to CNN and Federal News Network, a Pentagon official said the breach affects roughly 2.8 million living people and close to 300,000 who are deceased. For context, as of March the US armed forces counted 1.3 million active service members.

The DMDC may be little known to the public, but it is one of the Defense Department's key record-keeping units. It maintains more than 60 million records on military and civilian staff and their families, used to determine benefits such as healthcare and retirement. The center also describes itself as the military's "leading identity management provider," linking personnel to their credentials, smart cards, and passwords for access to computer systems, buildings, and bases. "We make sure that the right people get access and the wrong people don't: security of identity information is paramount," its website reads.

The department's response

The Department of Defense said it has no indication the stolen information was misused, but did not explain how it reached that conclusion. When TechCrunch asked whether officials had received any communications from the hackers — whose identities are unknown — the Pentagon did not respond.

This is merely the latest theft of federal workers' data. Earlier in September, the FBI suffered a breach attributed to the ShinyHunters group; the hackers claimed to have taken the personal information of most of the bureau's agents and staff, including applicants. That incident was described as a "counterintelligence disaster" over the risk that a foreign government could use the data to profile, target, or coerce employees. And in 2015, a breach of the US Office of Personnel Management, attributed to China, exposed the records of more than 22 million government workers, many with security clearances.

Source: TechCrunch