DMDC Data Breach Exposes Personal Information of 3 Million People

The US Defense Manpower Data Center (DMDC), which manages personnel records for the Department of Defense, has notified millions of individuals that their personal information was exposed following a data breach.

The incident involved unauthorised access to a DMDC file-sharing server, which allowed the exposure of unencrypted personally identifiable information (PII). The vulnerability was discovered on 16 July 2026, but analysis indicates that unauthorised users may have had access to the files for approximately nine months, with the exposure beginning around October 2025.

Scope of the Breach

The breach impacts an estimated 2.76 million living individuals and 294,000 deceased persons, according to officials. The DMDC maintains a vast repository of data, holding at least 60 million records as of the 2024 fiscal year. These records cover military and civilian personnel, contractors, family members, retirees, and veterans.

The exposed records contained sensitive data that varied by individual, including Social Security numbers, names, dates of birth, contact details, demographic information, and military occupational specialties.

Response and Investigation

DMDC confirmed that the vulnerability in the file-sharing system was patched and the system was restored immediately upon discovery. The agency has since launched privacy and cybersecurity incident response protocols to address the breach.

While the agency stated that there are currently no indications that the accessed information has been misused, the identity of the threat actor remains unknown. No known cybercrime group has claimed responsibility for the incident.