The agency that keeps the United States military's personnel records has begun telling roughly three million people that their information was stolen. The Defense Manpower Data Center, part of the Pentagon, says intruders were able to get into one of its file sharing systems and went undetected there for about nine months.
According to the notification letter the agency has been sending out, dated September 18, the data sitting on that server was not encrypted and included Social Security numbers. For records built around current and former service members, that is close to a worst case. It is the kind of identity information that does not change and cannot be reissued the way a password can.
What was taken, and from whom
Officials have put the scale at about 2.76 million living people and another 294,000 who have died, a little over three million in total. What was exposed varies from one person to the next, but the letter describes a mix that includes Social Security numbers, names, dates of birth, contact information, demographic details such as sex and race, and information tied to a person's military role.
The Defense Manpower Data Center is not a small or obscure office. It holds more than 60 million records covering service members, civilian employees, contractors, family members, retirees and veterans, and that data is used to confirm who is entitled to benefits and to run the department's personnel programs. A breach of the system that underpins those checks reaches far beyond any single base or branch.
A long window, found late
The timeline in the letter is what stands out. The agency says unauthorized users were able to reach files on the affected server between October 2025 and the point of discovery, which it gives as mid July 2026. That is roughly nine months in which outsiders could read what was there. The flaw was in a file sharing system, and the agency says it patched the system and brought it back into service as soon as the issue was spotted.
Beyond that, the public account is thin. The letter does not name the product that was vulnerable or explain how the flaw worked, and it describes those responsible only as a small number of unauthorized users. The department has said it has no sign so far that the stolen information has been misused. That counts for little with data this durable, where misuse can surface years after the theft.
What affected people can do
Those who receive a letter are being offered a year of free credit monitoring. That helps with the most immediate risk, which is someone using the stolen details to open accounts or file fraudulent claims, but it is not a complete answer. People in this position are usually advised to go further:
- Place a freeze on credit files, which blocks new accounts from being opened without the person lifting it first.
- Watch bank and benefit accounts closely, and treat unexpected calls or emails about military benefits with suspicion, since the stolen details make convincing lures.
- Keep an eye out well beyond the monitoring period, because a Social Security number taken today can be used long after the free coverage ends.
The breach arrives during a stretch in which several federal systems have been hit, and it underlines a problem that no amount of credit monitoring fixes. When an organization stores decades of unchangeable personal data in one place, the consequences of a single overlooked flaw are measured in millions of people and in years, not in the days it took to patch the hole.
