\n<\/p>\n
The U.S. government is reportedly alerting millions of current and former U.S. military service members and staff that their personal information was stolen during a months-long breach of the Pentagon\u2019s personnel records, the latest in a spate of thefts involving federal workers\u2019 data in recent months.<\/p>\n
A data breach notification from the Defense Manpower Data Center (DMDC) shared on Reddit<\/a> says that several unauthorized users exploited a security vulnerability in an unspecified file-sharing system over several months between October 2025 and mid-July 2026.<\/p>\n The breach exposed personally identifiable information, including Social Security numbers, alongside a person\u2019s name, date of birth, sex, race, and other information about their military service. The notice says that the personnel records were unencrypted.<\/p>\n According to CNN<\/a> and Federal News Network<\/a>, a Pentagon official said the breach affects about 2.8 million living people, and close to 300,000 people who are deceased.<\/p>\n The U.S. military has 1.3 million active service members as of March.<\/p>\n The DMDC may not be widely known to the general public, but serves as one of the Department of Defense\u2019s records-keeping units. The DMDC maintains over 60 million records for U.S. military and civilian staff and their family members to help determine benefits and entitlements, such as healthcare and retirement. The unit also provides a critical service as the military\u2019s \u201cleading identity management provider,\u201d which links active service members, employees, and contractors to credentials, such as smart cards and passwords. These are used to access Pentagon computer systems, buildings, and bases.<\/p>\n \u201cWe make sure that the right people get access and the wrong people don\u2019t: security of identity information is paramount,\u201d the DMDC\u2019s website reads.<\/p>\n The Department of Defense, which oversees the DMDC, said it does not have any indication that the information was misused, but did not say how it reached that conclusion. TechCrunch contacted a Pentagon spokesperson to ask if officials had any communications from the hackers, whose identities are not known, but we did not hear back.<\/p>\n This is the latest major breach of federal workers\u2019 personal information in recent months, following a recent breach at the FBI earlier in September<\/a> attributed to the ShinyHunters hacking group. The hackers told TechCrunch that they had taken the personal information of most of the FBI\u2019s agents and staffers, including applicants. The breach has been billed as a \u201ccounterintelligence disaster\u201d amid the risks that a foreign government could obtain and use the information to profile, target, or coerce federal workers into handing over sensitive information.<\/p>\n The ShinyHunters hackers have said that they will not publicly release the stolen FBI data<\/a>.<\/p>\n Both breaches involving the FBI and the DMDC mirror similar thefts of government personnel records in the past. In 2015, a breach of the U.S. government\u2019s human resources department, known as the Office of Personnel Management, was broadly attributed to China. The theft allowed the hackers to steal the private records of more than 22 million U.S. government employees, many of whom had security clearances.<\/p>\n Did you receive a notice about this data breach? We want to hear from you. You can contact this reporter securely on Signal at zackwhittaker.1337, or reach him by email at zack.whittaker@techcrunch.com.<\/em><\/strong><\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n