US DoD confirms Defense Manpower Data Center breach exposing personal data of about 3 million people
The US Department of Defense has confirmed a breach of the Defense Manpower Data Center (DMDC), one of its main personnel data repositories. The breach exposed sensitive data on roughly 2.76 million people plus about 294,000 deceased individuals. Unauthorised users reportedly accessed files between October 2025 and 16 July 2026, and the intrusion went unnoticed for about nine months until a vulnerability in a file-sharing system was found and patched. The Pentagon says it has seen no evidence of misuse so far and is offering 12 months of identity protection and credit monitoring. The article does not attribute the intrusion to any actor.
Technical Details
- Access began in October 2025 and lasted until 16 July 2026, roughly nine months of undetected access.
- The root cause was a vulnerability in a file-sharing system; no CVE is named.
- The exposed files were unencrypted. They held Social Security numbers, names, dates of birth, contact details and other military personnel data, in some cases including job details.
- Roughly one in twenty of the more than 60 million DMDC records were affected.
- Job details could make spear-phishing and extortion against military personnel by foreign intelligence services or criminals far more convincing, as CNN noted.
- The article separately mentions an FBIJobs.gov portal breach claimed by ShinyHunters. It presents that breach as unrelated.
Remediation
- Affected individuals should enrol in the offered identity protection and credit monitoring and watch for targeted phishing.
- Organisations should patch file-sharing systems, encrypt sensitive data at rest, and improve detection of long-dwell unauthorised access.
Linha do tempo
-
US DoD confirms Defense Manpower Data Center breach exposing personal data of about 3 million people
ler a análise desta fonte ocultar
The US Department of Defense has confirmed a breach of the Defense Manpower Data Center (DMDC), one of its main personnel data repositories. The breach exposed sensitive data on roughly 2.76 million people plus about 294,000 deceased individuals. Unauthorised users reportedly accessed files between October 2025 and 16 July 2026, and the intrusion went unnoticed for about nine months until a vulnerability in a file-sharing system was found and patched. The Pentagon says it has seen no evidence of misuse so far and is offering 12 months of identity protection and credit monitoring. The article does not attribute the intrusion to any actor.
Technical Details
- Access began in October 2025 and lasted until 16 July 2026, roughly nine months of undetected access.
- The root cause was a vulnerability in a file-sharing system; no CVE is named.
- The exposed files were unencrypted. They held Social Security numbers, names, dates of birth, contact details and other military personnel data, in some cases including job details.
- Roughly one in twenty of the more than 60 million DMDC records were affected.
- Job details could make spear-phishing and extortion against military personnel by foreign intelligence services or criminals far more convincing, as CNN noted.
- The article separately mentions an FBIJobs.gov portal breach claimed by ShinyHunters. It presents that breach as unrelated.
Remediation
- Affected individuals should enrol in the offered identity protection and credit monitoring and watch for targeted phishing.
- Organisations should patch file-sharing systems, encrypt sensitive data at rest, and improve detection of long-dwell unauthorised access.