DMDC Data Breach Exposed Personal Information of 3.05 Million People
Summary
The Defense Manpower Data Center says unauthorized users accessed files containing unencrypted personal information from October 2025 until the vulnerability was discovered in July 2026. A Department of War official told CNN about 3.05 million people were affected.
Key points
- DMDC says unauthorized users accessed files on a file-sharing server from October 2025 until the issue was discovered on July 16, 2026.
- The agency says it patched the vulnerability and restored the system after discovery.
- Exposed information varied by person and included Social Security numbers, names, birth dates, contact and demographic details, and military occupational specialties.
- DMDC's notice did not state the number affected; a Department of War official told CNN the breach impacted 2.76 million living and 294,000 deceased people.
- DMDC said it had no indication the accessed information had been misused, and the attacker’s identity is unknown.
Article Details
- Victim Organization
- US Defense Manpower Data Center (DMDC)
- Incident Type
- Unauthorized access to files on a DMDC file-sharing server through a security vulnerability
- Disclosure Date
- 2026-09-18
- Data Types Exposed
- Social Security numbers
- Names
- Dates of birth
- Contact details
- Demographic data
- Military occupational specialties
- Affected Records
- A Department of War official told CNN the breach affected 2.76 million living individuals and 294,000 deceased individuals.
- Operational Impact
- The vulnerability was discovered on July 16, 2026; DMDC patched the file-sharing system and restored it. DMDC said it had no indications of misuse of the accessed information.
- Claim Status
- confirmed