Pentagon Personnel Records Breach Exposes 2.76 M Social Security Numbers and Military Data
What Happened
Cyber‑actors accessed an unencrypted file‑sharing server used by the Defense Manpower Data Center (DMDC) and extracted personal data for 2.76 million living individuals and 294 k deceased persons. The intrusion persisted from October 2025 through July 2026; the Pentagon has not observed evidence of data misuse to date.
Why It Matters for Compliance & Audit Readiness
- Continuous control‑assurance programs must document privileged‑access monitoring and enforce encryption for all PII repositories, preventing prolonged undetected exposure.
- Robust data‑classification and handling policies (e.g., NIST 800‑53 PL‑2, ISO 27001 A.8) provide defensible evidence during audits that high‑value records are protected by layered controls.
- Incident‑response and third‑party risk‑management processes should capture vendor‑related file‑sharing components, ensuring that any external system is subject to the same assurance controls as internal assets.
Who Is Affected
- Current and former U.S. Department of Defense military personnel
- Civilian DoD employees and contractors
- Veterans and their dependents
- Estate administrators of deceased record holders
Recommended Actions
- Inventory all DMDC‑related data flows and confirm encryption at rest and in transit.
- Validate that privileged‑access logs are retained for at least one year and that anomalous activity alerts are active.
- Request a detailed incident‑response report from the Pentagon’s cyber‑security office, including any remediation steps taken.
- Advise affected individuals to enroll in the offered credit‑monitoring service and consider a credit freeze.
Technical Notes
- Attack vector: Exploitation of a vulnerability in an unspecified file‑sharing system that stored unencrypted PII.
- CVEs: None publicly disclosed for the specific vulnerability.
- Data types exposed: Social Security numbers, full names, dates of birth, gender, race, service details, contact information, occupational specialty.
Source: Malwarebytes Labs – Pentagon breach exposes Social Security numbers and military records of millions