Pentagon HR System Exposed Troops' SSNs for Nine Months

Unauthorized users accessed a Defense Manpower Data Center server from October 2025 to July 2026, exposing Social Security numbers of military personnel.

Unauthorized users began accessing files on a vulnerable file-sharing server operated by the Defense Manpower Data Center in October 2025. The intrusion went undetected until July 16, 2026, when DMDC identified the security vulnerability, patched it, and restored the affected system — meaning the environment was potentially exposed for approximately nine months. DMDC is the Pentagon organization responsible for maintaining extensive personnel records tied to military service and the broader Defense Department community, holding more than 60 million records on military and civilian personnel, contractors, family members, retirees and veterans.

The most striking detail is not the intrusion itself but its dwell time: an unencrypted repository of personnel data sat reachable by unauthorized users for roughly three quarters of a year inside the Pentagon's own personnel infrastructure. Grants Pass Tribune reports that an examination launched after discovery found files containing unencrypted personally identifiable information had been accessed, and that investigators are now examining how unencrypted data remained accessible through the file-sharing system and how the intruders reached it for months before detection. The incident joins the 2015 OPM breach among major federal personnel-data compromises, though the publicly identified information here does not include the same depth of security-clearance material.

Notification letters confirm that unauthorized users accessed each recipient's Social Security number plus at least one additional identifying item — name, date of birth, contact information, sex, race, or military occupational specialty, according to Artvoice's account of the letters. The Pentagon has not established a final count of affected individuals, but Artvoice reports that two people familiar with the incident put the figure at approximately four million Department of Defense personnel — an estimate that has not been officially confirmed and represents only potentially affected personnel, not the full 60 million records DMDC holds.

Because the compromised records involve people connected to the U.S. military, the exposure carries consequences beyond ordinary identity theft. Grants Pass Tribune notes that military occupational specialties can reveal professional training, technical expertise and roles within the armed forces; combined with commercial databases, prior breaches and public records, they could enable targeted profiles of individual service members. Artvoice adds that national security experts are alarmed: during the Iran conflict, U.S. Central Command warned lawmakers that adversaries have exploited commercial location data to surveil U.S. personnel, and stolen DMDC data fused with commercial datasets could build targeting profiles including debts, spending habits and physical movements. No federal agency has attributed the intrusion to any specific actor, and the Pentagon says it has no indication of misuse so far.

Local coverage confirms the blast radius extends well beyond active duty. WHIO TV reports that veterans and active service members are among those affected after the Pentagon breach, while KXLY likewise covered the breach of military personnel data this week. Notification letters are now being sent to affected individuals, and the Defense Department is providing one year of credit monitoring and identity-restoration services through IDX, a private contractor, per Grants Pass Tribune. Because Social Security numbers cannot be reset like passwords, affected individuals face long-tail risks of fraudulent accounts and identity theft that outlast any single monitoring window.

The federal investigation now centers on three questions, as Grants Pass Tribune frames them: whose information was exposed, precisely what was obtained, and what happened to the data during the months the vulnerable system remained accessible. Defense officials are examining department systems for additional vulnerabilities or evidence of unauthorized access, and investigators have not publicly determined whether information was copied, retained or distributed after the files were accessed. Full dimensions of the breach remain unestablished — the responsible party, the confirmed scope, and any downstream exploitation are all still open findings that will shape how the Pentagon secures its central personnel repositories going forward.