Pentagon personnel data breach exposed records of more than 3 million people

For roughly nine months, unauthorized users could read files holding Social Security numbers of people who served in or worked for the U.S. military. A breach of a Defense Department personnel system exposed sensitive records belonging to about 2.76 million living people and 294,000 people who have died, Help Net Security reported, bringing the total to just over 3 million. If you or someone in your family has military ties, this Pentagon data breach is worth an hour of your time this week.

What happened in the Pentagon data breach

According to Help Net Security, attackers had access to a system run by the Defense Manpower Data Center between October 2025 and July 2026. The center, created in 1974, holds records on service members, veterans, civilian employees and their families. MOAA, the Military Officers Association of America, reported that the center held more than 60 million personnel records as of fiscal 2024.

Help Net Security reported that the problem was a security flaw in a file sharing system that allowed unauthorized access to files, and that the center found it through its own analysis on July 16, 2026. In the department's words, as quoted by Help Net Security, "a small number of unauthorized users accessed files on a server containing unencrypted PII." PII stands for personally identifiable information.

Two details in that sentence stand out. The data was unencrypted, and access went unnoticed for most of a year. Neither is unusual in large breaches, but both are the kind of thing security reviews are supposed to catch.

MOAA reported that notices went out on September 18, and that early reports had put the number of affected people at about 4 million before it was revised down. The department has said it has no indications that the information has been misused.

What was exposed

The exposed data includes:

• Social Security numbers.
• Full names and dates of birth.
• Contact details.
• Sex and race information.
• Military service information, including job specialties.

Taken together, that is close to a complete identity kit. A Social Security number plus a name and birth date is enough to try opening credit accounts, filing a fake tax return or passing basic identity checks on the phone. Military service details make it easier to impersonate the Defense Department, the VA or a unit administrator convincingly.

Who is affected

According to MOAA, the records cover active duty and reserve service members, veterans, military family members and people who have died. Records of deceased people may sound low risk, but they are a known target for fraud because no one is watching the accounts. If a parent or spouse who served has died, their surviving family should take the steps below on their behalf.

What the Pentagon is offering

Affected people are being offered 12 months of credit monitoring through IDX, a breach response company, Federal News Network reported. Enrollment is open until August 19, 2027. MOAA reported that the enrollment page is at response.idx.us/DMDC, and that people should have received a notification letter.

Monitoring tells you after something happens, such as a new account opening in your name. It does not stop it. That is why it should be paired with a freeze.

What to do now

If you or a family member served in the military or worked for the Defense Department, take these steps:

1. Watch for an official notification letter and enroll in the free monitoring. Use the address in the letter or type it into your browser yourself. Do not follow links from unexpected emails or texts.
2. Freeze your credit with Equifax, Experian and TransUnion. It is free and blocks most new account fraud. You can lift the freeze for a day when you apply for a loan or a card.
3. Be suspicious of calls, texts or emails that mention your service record. Scammers often use real stolen details to sound official. A caller who knows your unit or job specialty is not proof they work for the government.
4. Request an Identity Protection PIN from the IRS. It stops anyone else from filing a tax return using your Social Security number.
5. Check your credit reports. You can get them free from each bureau. Look for accounts or inquiries you do not recognize.
6. Report identity theft quickly. MOAA pointed people to identitytheft.gov, the Federal Trade Commission's recovery site, which builds a step by step plan.

A credit freeze is the single most useful step, because Social Security numbers do not expire and a year of monitoring will not cover the long tail of risk.

The scams to expect next

Breaches like this tend to be followed by targeted fraud rather than random spam. A few patterns are worth knowing:

• Fake breach notices. Emails or texts that claim to come from the Pentagon or IDX and ask you to "confirm" your Social Security number. The real letter will not ask you to send it back.
• Benefits scams. Calls about a VA claim, a pension adjustment or back pay that require a fee or your bank details.
• Voice impersonation. With AI tools, a caller can sound like a commanding officer or a relative in trouble. Our guide to spotting AI voice and video deepfake scams explains how to set up a family code word.
• Investment pitches aimed at veterans. Some crypto and "guaranteed return" schemes target military communities. Read how to spot a crypto scam before you send money anywhere.

Protect your accounts, too

Stolen personal data makes account takeover easier, because answers to security questions and recovery details are often sitting in the leaked records. Spend ten minutes on the steps in our guide to protecting your online accounts: lock down your email first, turn on two step verification and stop reusing passwords. A password manager makes the last part painless.

What to watch next

Several questions remain open. The department has not publicly explained who the unauthorized users were, how the flaw went unnoticed for so long, or what changes it is making beyond saying it is working to improve the system's security. Lawmakers who oversee the military and veterans groups are likely to press for answers, and those hearings or letters may reveal more. Watch, too, for whether the monitoring period is extended. A single year is short for data that stays useful to criminals for a lifetime.

Government systems are not the only ones under pressure. The same month, attackers were exploiting critical Citrix NetScaler flaws that sit at the edge of many corporate and public networks. More security coverage is in our tech section.

Frequently asked questions

How do I know if I am affected?

The Defense Department has sent notification letters to affected people. If you served, worked for the department, or are a family member of someone who did, watch your mail and check the enrollment site listed in the letter.

Is the free credit monitoring enough?

It helps, but it only alerts you after a problem. A credit freeze at all three bureaus prevents most new accounts from being opened in your name, and it lasts as long as you keep it.

What should I do for a relative who has died?

Their records may be among the 294,000 deceased people affected. Contact the three credit bureaus to place a deceased flag or freeze on the file, and keep an eye on any mail that arrives in their name.

Has the stolen data been misused?

The department has said it has no indications of misuse. That can change, and stolen Social Security numbers are often used months or years later, so protective steps are still worth taking.