Pentagon Data Breach Compromised Millions of Social Security Numbers and Military Records

A significant data breach at the Pentagon's Defense Manpower Data Center (DMDC) has exposed the personally identifiable information of approximately 2.76 million living individuals and 294,000 deceased individuals. The breach, which occurred between October 2025 and July 2026, involved unauthorized access to unencrypted data, raising concerns about long-term identity theft risks for those affected, including military personnel, veterans, and their families.

A War Department official confirmed the scope of the breach, stating that exposed information can include Social Security numbers, names, dates of birth, contact details, sex, race, and military personnel specifics such as occupational specialties. The DMDC maintains records for over 60 million individuals, supporting benefits, verification, and other Defense Department programs, making the compromised data particularly sensitive.

How the Breach Occurred

The unauthorized access was discovered by the DMDC, which then remediated the vulnerability. While the department stated there is no current indication that the accessed information has been misused, the unencrypted nature of the data meant a potentially extended exposure window before detection.

Notification and Protection Measures

Individuals whose information was accessed are being notified by postal mail through Identity Theft Guard Solutions (IDX), a contracted provider. The notification letters will detail the specific data elements affected and outline the protection services offered. IDX is providing notification, credit monitoring, and identity restoration support.

Those with questions can visit response.idx.us/DMDC or call 1-855-744-4556. The Pentagon is cautioning recipients to be wary of potential scams and to verify any communications through official channels rather than clicking on unsolicited links.

Long-Term Risks of Exposed Social Security Numbers

Unlike credit card numbers, Social Security numbers do not expire, posing a persistent risk for identity fraud. Criminals can combine this information with other data points to commit more sophisticated forms of identity theft, including opening new credit accounts or engaging in other fraudulent activities that may not immediately appear on credit reports.

Steps for Protecting Personal Information

Experts recommend several steps for those affected by the breach:

• Enroll in free monitoring services: Eligible individuals can receive 12 months of free credit monitoring and identity restoration support through IDX. For ongoing protection, individuals may consider broader identity theft protection services.
• Freeze credit: Placing a credit freeze with Equifax, Experian, and TransUnion restricts access to a person's credit file, making it more difficult for identity thieves to open new accounts. This freeze can be temporarily lifted when legitimate credit applications are needed.
• Consider a fraud alert: As an alternative to a freeze, a fraud alert can be placed on credit reports, requiring lenders to take extra verification steps before extending new credit.
• Monitor existing accounts: Regularly review bank and credit card statements for any suspicious activity and enable transaction alerts.
• Be cautious of phishing attempts: Scammers often exploit data breaches to send fake communications. Avoid sharing personal information or clicking on suspicious links in breach-related messages.
• Enable two-factor authentication (2FA): Activate 2FA on email, financial, and other important online accounts for an added layer of security.
• Obtain an IRS Identity Protection PIN (IP PIN): This six-digit PIN can help prevent someone from filing a fraudulent tax return using a stolen Social Security number.
• Continue vigilance: Even after free monitoring services end, it is crucial to continue monitoring credit reports and financial accounts for any signs of identity theft.

The DMDC breach highlights the enduring value of sensitive personal data to malicious actors and underscores the importance of proactive security measures for individuals whose information has been compromised.