Pentagon personnel data breach went unnoticed for nine months

What happened

The US Defense Manpower Data Center (DMDC) has started notifying people affected by a breach of one of its systems. On 16 July 2026, DMDC discovered a security vulnerability in a file-sharing system that allowed unauthorised users to access files. Between October 2025 and that date, a small number of unauthorised users accessed files on a server holding unencrypted personal data.

Who is affected

About 2.76 million living people, including current and former defence personnel, plus around 294,000 people who have died. Exposed data varies by person and includes names with Social Security numbers, dates of birth, contact details and military job specialties.

DMDC says it has no indication that the data has been misused. It has not said who accessed the files or whether they were copied, and no known criminal group has claimed the attack.

What to do now

• Check file-sharing and file-transfer systems for exposed or forgotten shares, and confirm sensitive data at rest is encrypted.
• Make sure access to these systems is logged and the logs reach your SIEM.
• Alert on unusual access patterns, such as new sources reading large numbers of files.

Why it matters for SOC teams

The attackers did not need malware. They used a weakness in a file-sharing system and read files for about nine months. Detection that relies only on endpoint alerts would not have seen it. Access logs from file-sharing platforms, and someone or something watching them, close that gap.