Military Notifies Troops of Major Cybersecurity Breach Exposing Millions of Personnel Records
The Pentagon has begun notifying service members of a significant data breach affecting the Defense Manpower Data Center, potentially compromising records of over 3 million individuals including current and former military personnel. Hackers maintained unauthorized access to the unencrypted database for approximately nine months between October 2025 and July 2026, with stolen information including Social Security numbers and other sensitive data. The breach notification offers 12 months of credit monitoring, though officials have not disclosed the attackers' identities or whether the compromised data has been misused.
The Defense Manpower Data Center serves as a critical repository for military personnel information across all service branches. The breach's nine-month duration—from fall 2025 through mid-2026—raises significant concerns about the attackers' capabilities and intentions, as such extended access could have enabled them to conduct thorough data extraction or move between connected military systems.
The decision to store sensitive records without encryption represents a fundamental security failure, particularly given the sensitivity of military personnel data. The Pentagon's notification process began only after the breach became public through social media, highlighting gaps in incident response protocols and transparency with affected service members.
This incident could impact millions of military personnel and their families through potential identity theft and fraud resulting from compromised Social Security numbers and personal information. Service members may face heightened vulnerability to targeted exploitation, while the military could experience operational security concerns if adversaries leverage stolen data for intelligence purposes. The extended unauthorized access period suggests attackers had time to thoroughly exploit the system, potentially creating long-term risks that may persist well beyond the 12-month credit monitoring period offered to affected individuals.