Pentagon DMDC data breach: what the 3 million notices mean

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

The Defense Manpower Data Center (DMDC), the Pentagon office that maintains Defense Department personnel records, is notifying about 3 million people that files containing their personal data were accessed without authorization. The files included Social Security numbers. DMDC is offering 12 months of free credit monitoring, and you have until August 19, 2027 to enroll.

What happened

According to reporting by Help Net Security and SecurityWeek, a small number of unauthorized users had been accessing DMDC files containing unencrypted personal data since October 2025. DMDC found the vulnerability on July 16, 2026. Notification letters began arriving in late September, with some dated September 18, and the incident became public on October 1, 2026.

A Defense Department official told CNN that about 2.76 million living people and 294,000 deceased people are affected (Reported). Those affected can include current and former service members, Defense Department personnel and their dependents (Reported).

DMDC says it "does not have any indications of misuse of the accessed information" (Confirmed, notification letter as reported). It has not said who accessed the files or whether they were copied.

What data was involved

The data varies by person. According to the notification letters (Confirmed, as reported by Malwarebytes and Help Net Security):

• Social Security number, for most recipients
• At least one other identifier, such as name, date of birth or contact details
• For some people, sex, race and military personnel details such as job specialty

A Social Security number combined with a name and date of birth is enough to attempt new credit applications or tax filings in your name. Names, dates of birth and contact details are also the kind of fields that already appear on people-search sites, so this incident can make those public profiles easier to match and misuse.

A proposed class action was filed on October 20, 2026 in federal court in Washington, D.C. Its claims are allegations and have not been decided.

What you can do now

1. Enroll in the monitoring. Use the enrollment code printed in your DMDC letter on the IDX website before August 19, 2027. Only use the code and link from your own letter.
2. Freeze your credit. Place a free freeze with Equifax, Experian and TransUnion. A freeze blocks most new credit applications until you lift it, and it does not affect your existing accounts.
3. Get an IRS Identity Protection PIN. It stops anyone else from filing a federal return with your Social Security number. You can request one at IRS.gov.
4. Treat service-related messages with care. Someone who has your name, contact details and service history can make a call or email sound official. If a message asks for codes, account access or payment, hang up and call back on a number you find yourself.
5. Handle notices for deceased family members. If you received a notice for a relative who has died, you can ask each credit bureau to flag that person's file as deceased, which helps stop new accounts being opened in their name.
6. Report misuse. If you see accounts or tax filings you did not make, report it at IdentityTheft.gov.