DMDC breach exposed data on 2.76 million living people and 294,000 deceased people

A security flaw in a file-sharing system used by the Defense Manpower Data Center (DMDC) exposed personal information tied to 2.76 million living people and 294,000 deceased people, according to an official cited by CNN. The DMDC is the US Department of Defense personnel-data agency.

A breach notification letter said the vulnerability was discovered on July 16, 2026, and that the system was updated and restored. An investigation found that an intruder had accessed servers containing unencrypted personal data in October 2025. Information was extracted from then until July 2026.

The exposed data included Social Security numbers, names, birth dates, contact details, sex, race and military personnel information such as occupational specialty. The source report said the DMDC handles more than 60 million records. It did not identify the file-sharing system or describe the vulnerability.

The Department of Defense said there were “no indications” that the files had been misused. The agency said it was offering 12 months of credit monitoring through IDX. The report cited CNN’s account that occupational specialty information combined with Social Security numbers could be valuable to foreign state-backed threat actors. It did not establish who carried out the breach or identify the file-sharing service.