News · Breach Analysis · Breaking

Pentagon breach exposes records of 2.76 million military personnel

Intruders reached a Defense Manpower Data Center server for nine months, exposing unencrypted Social Security numbers and occupational details of current and former US military personnel, CNN reports.

Mark FermorCTO, CMO and Founder, Firevault

Published 2 November 2026 · 4 min read

What happened

Nine months of unnoticed access exposed the personal records of millions of people connected to the US military. CNN reports that "unauthorised users" gained access to a vulnerable server belonging to the Defense Manpower Data Center (DMDC), the Pentagon's central personnel and benefits data system.

According to a letter sent to victims and reviewed by CNN, the access began last October. The Pentagon did not discover and remediate the issue until July this year.

A Defense Department official told CNN that the breach affects 2.76 million living individuals, a category that may include current and former personnel and their dependents, and 294,000 deceased individuals.

What is known about the exposure

The letter states that the breached data included Social Security numbers and other personal information. In some cases it also included the occupational specialty of service members.

CNN reports that the data was not encrypted, according to the letter. The Pentagon says it currently has no indication that the data has been misused, and it is offering victims one year of credit monitoring.

It is not known who was behind the breach. CNN reports that a Pentagon spokesperson did not immediately respond when asked.

For context, the DMDC held at least 60 million records as of fiscal year 2024, according to its website. That is the size of the system, not the number of records breached.

Why this matters

The concern goes beyond identity fraud. Experts quoted by CNN warn that occupational details, combined with Social Security numbers and commercially available data, could help a foreign intelligence service work out who does what for the US military and where.

Two failures stand out. The intrusion went undetected for nine months, and the data that was reached was unencrypted. Either control, working as intended, could have reduced the harm.

The DMDC describes itself as the central access point for entitlements, benefits and medical readiness information. When a single system holds this much sensitive data, a single vulnerable server can expose a very large population.

The practical response

For organisations that hold large personnel or customer datasets:

• Encrypt sensitive records at rest, so that a compromised server does not hand over readable data.
• Monitor for unusual access to bulk records, and test how quickly it would be noticed.
• Keep only the data each system genuinely needs, and remove older records it no longer requires.
• Prepare guidance for the people affected about targeted phishing that uses their real details.

These are Firevault recommendations, not claims about which specific controls the DMDC had in place.

Where physical disconnection helps, and where it does not

Offline Secure Storage® keeps selected retained copies physically disconnected by default, with hardware-enforced isolation while disconnected. Authorised access uses a separate, non-IP connection-control process, and the connection is physically broken again when the session ends.

A personnel system that serves benefits and entitlements needs to stay online, so physical disconnection would not protect its working records. It can protect retained copies, such as historical archives and recovery sets, which do not need a live network path. A disconnected copy cannot be reached through a vulnerable online server.

The useful question is which records must be reachable all the time, and which can be held offline until they are deliberately required.

Explore OSS for Business.

Source

CNN: Pentagon data breach of military personnel raises national security concerns, by Sean Lyngaas and Davis Winkie, published 25 September 2026 and updated 28 September 2026, accessed 2 November 2026. Figures and statements above are attributed to that reporting; Firevault has not independently verified the incident.

Analysis by Mark Fermor. Featured image is an AI-generated editorial illustration, not a photograph of any Defense Department facility.