Skip to content

Pentagon Letters Say Unauthorized Users Read DMDC Records

The Pentagon told people that unauthorized users reached Defense Manpower Data Center records. Letters describe Social Security numbers and a nine-month window.

By THEYDIDNTASK
Pentagon Letters Say Unauthorized Users Read DMDC Records
Pentagon Letters Say Unauthorized Users Read DMDC Records

TL;DR

  • —Notification letters say unauthorized users accessed the Defense Manpower Data Center.
  • —Reporting on those letters puts the exposed set near 3 million people, including deceased records, with Social Security numbers in the file.
  • —The Department of Defense has not named the users or a motive. It says it has no evidence of misuse and is offering a year of credit monitoring.
What the letters say In late September 2026, service members and families began comparing letters that said unauthorized users had accessed the Defense Manpower Data Center. DMDC is the personnel system behind military, civilian, veteran, retiree, and family records. Privacy Guides, citing those letters and Cybersecurity News, reported an exposed set of about 3 million people: roughly 2.76 million living and 294,000 deceased. The fields described in the notices are the ones that do not expire. Names, dates of birth, contact information, sex, race, occupational specialty, and Social Security numbers. The access window in the reporting runs from October 2025 to discovery on July 16, 2026. The stored data was not encrypted. What is not in the letters The department has not identified the users or a motive. It says it has no evidence the data has been misused. Affected people were offered one year of credit monitoring through IDX. A year of monitoring does not match a Social Security number, which is not rotated when the year ends. The 60 million figure attached to DMDC in secondary writeups is the size of the system, not the size of the exposed set. Keep those apart. The exposed count that the letters and Cybersecurity News support is the smaller one. The receipt People in this file did not opt into a nine-month open read of an identity number they cannot change. The notice is the receipt: unauthorized users, unencrypted personnel data, no named intruder, a monitoring coupon. That is the whole public record until the department publishes a narrower one.

Sources