DMDC Incident Affected More Than 3 Million Records
The U.S. Department of Defense confirmed unauthorized access to personal data in the DMDC system. The incident involved 2.76 million living people and 294,000 deceased people.
DMDC incident affected data on more than three million people. According to its statement, the U.S. Department of Defense confirmed unauthorized access to data in the Defense Manpower Data Center (DMDC) system between October 2025 and July 2026.
According to the department’s statement, the incident involved 2.76 million living people and another 294,000 deceased people. The total scope therefore exceeds three million records. DMDC is the Department of Defense’s central organization for identification, authentication and personnel data.
DMDC incident involved sensitive identification data
The scope of the exposed data varied by individual. The notification letter and statements mention unencrypted names, contact details, dates of birth, Social Security numbers and employment or military affiliation information.
The combination of Social Security numbers with contact and personnel data increases the risk of identity theft, phishing and targeted social engineering.
However, it has not been publicly confirmed which exact set of data was accessible for each affected person. It is also unknown which specific groups of people made up the affected population.
File-sharing system flaw fixed in July
DMDC stated that after discovering the problem on July 16, 2026, it fixed the vulnerability in the file-sharing system and launched an incident response.
The Department of Defense has not yet released technical details about the vulnerability or how unauthorized access to the system was obtained. No possible attacker has been publicly identified either. A connection to a state actor or a specific cybercrime group has not been confirmed.
It has likewise not been publicly confirmed whether data was exfiltrated from the system. The Pentagon said it currently has no evidence that the exposed data was misused. It is offering affected people protection services.
Department offers one year of identity monitoring
The U.S. Department of Defense is offering affected people 12 months of credit history monitoring and identity protection.
What comes next
Further information could come from the investigation into the incident. The key questions will be whether the data was removed from the system or used, as well as the release of technical details about the unauthorized access. Possible attribution of the attack to a specific actor also remains open, as does any change in the number or scope of the notified records.
Sources
- ABC News – Reports a defense official’s statement on the access period, the number of 2.76 million living and 294,000 deceased people, the vulnerability fix and the lack of evidence of misuse so far.
- Federal News Network – Confirms the scope of the incident, the nature of the exposed data, the date the flaw was discovered and the identity monitoring offered.
- Military Times – States that the notification letter describes a vulnerability in the file-sharing system, unencrypted personal data and an access period lasting through July 16, 2026.
- Defense Manpower Data Center – The official page confirms DMDC’s role as a central source for identification, authentication and personnel data within the DoD.
Verified and updated: 09/29/2026 15:22
