Pentagon personnel records of over 3 million people were stolen

The U.S. Defense Manpower Data Center (DMDC), which keeps personnel records for the Department of Defense, is notifying people that attackers had access to their data for about nine months. Pentagon officials say more than 3 million people are affected, including 294,000 who have died. If you served in the U.S. military, or are family of someone who did, here’s what is known.

What happened

According to notification letters shared online and reported by BleepingComputer, the DMDC told recipients that “a small number of unauthorized users” had access to their information between October 2025 and July 2026, after exploiting a vulnerability in its file-sharing systems.

The data varies by person and includes:

• Social Security numbers
• names and dates of birth
• contact information
• sex and race
• military personnel information

Pentagon officials told Federal News Network that more than 3 million people are affected: nearly 2.8 million living people and 294,000 deceased. The DMDC holds more than 60 million records on service members, civilians, contractors, families, retirees and veterans, so these letters cover only part of what it stores.

The Pentagon hasn’t said who was behind the access.

What this means for you

Nine months is a long time for someone to have access. A Social Security number, birth date and service history together are enough for convincing benefits fraud and for targeted scams aimed at veterans and military families.

The records of people who have died matter too. Identity thieves use the details of deceased people to open accounts, because nobody is watching that credit file. If you handle the affairs of a service member who has passed away, the letter may come to you.

What you can do

1. Enrol in the free monitoring before the deadline. The Pentagon is offering 12 months of credit monitoring through IDX. You have to enrol by August 19, 2027.
2. Freeze your credit. A security freeze at each of the three U.S. bureaus is free and stops most new-account fraud. You can also request one on behalf of a deceased family member.
3. Watch for scams that use service details. Expect calls or emails that quote your unit, rank or benefits to sound official. Don’t give information to an incoming call; contact the agency on a number you look up yourself. See how scammers use leaked data.
4. If you live in Canada and served in the U.S. military, the same steps apply, plus a fraud alert with Equifax Canada and TransUnion Canada. See what to do after a data breach in Canada.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.

Sources

• BleepingComputer, Hackers stole Pentagon personnel records of over 3 million people, October 1, 2026