Pentagon breach exposed personnel data of nearly 3 million people for months
A vulnerability in a Defense Department personnel-data system exposed unencrypted records from October 2025 until its discovery on 16 July 2026, according to a notification letter obtained by Nextgov. The breach affected 2.76 million living people and 294,000 who had died, a defence official told CNN; the data included Social Security numbers and military roles, which could help attackers target individuals.
Bottom line — The Pentagon has patched the flaw and is offering affected people a year of credit monitoring, but has not explained how it concluded the data has not been misused.
Go deeper 6
-
Nextgov reports that the affected system, run by the Defense Manpower Data Center, held unencrypted files accessed without authorisation for roughly nine months.
-
The notification letter listed names, birth dates, contact details and military occupational specialties among the exposed information, depending on the individual.
-
CNN reported that occupational specialties could help foreign intelligence services identify people with roles of particular interest.
-
The department said there were no indications of misuse, according to the notification letter; Ars Technica noted that officials have not explained how they reached that conclusion.
-
The disclosure follows a separate breach claimed by ShinyHunters involving FBI personnel records; Nextgov said there is no public evidence linking the two intrusions.
-
Nitay Milner of ORION Security told Nextgov that the length of time the access went undetected is a central concern, beyond the number of people affected.