A data breach at the Pentagon’s Defense Manpower Data Center has exposed personal information belonging to 2.76 million living individuals and 294,000 deceased individuals, according to a War Department official. The agency maintains records tied to the military community, including service members, veterans, civilian employees, contractors and family members.
The official said an information system at the Defense Manpower Data Center, known as DMDC, experienced unauthorized access by a small number of unauthorized users between October 2025 and July 2026. The War Department says it has no indication at this time that the accessed information has been misused, and that the vulnerability was remediated immediately after it was discovered.
The exposed files were unencrypted and, depending on the individual, could include Social Security numbers, names, dates of birth, contact information and military personnel details. DMDC holds more than 60 million records used to support benefits, identity verification and other Defense Department programs, meaning people who left active service years ago may still be affected.
How people are being notified
Affected individuals are being notified by postal mail through the department’s contracted provider, Identity Theft Guard Solutions, known as IDX. According to the War Department official, IDX is offering notification, credit monitoring and identity restoration support based on which data elements were affected for each person. Those with questions can visit response.idx.us/DMDC or call 1-855-744-4556.
Officials and security experts are warning people to be wary of unexpected emails or texts claiming to be tied to the breach, since scammers often use major security incidents to send fake notices. Anyone who receives such a message is advised to verify it using the official IDX contact information or the postal notice received, rather than clicking links in an unsolicited message.
What affected individuals can do
Eligible individuals may receive 12 months of free credit monitoring and identity restoration support through IDX, depending on what information was exposed. Security experts also recommend additional steps for anyone whose Social Security number may have been compromised, including:
- Placing a credit freeze with Equifax, Experian and TransUnion to make it harder for someone to open new credit in your name
- Placing a fraud alert with one of the three major credit bureaus if a full freeze isn’t preferred
- Regularly reviewing bank and credit card statements and turning on transaction alerts
- Enabling two-factor authentication on email and financial accounts
- Requesting an IRS Identity Protection PIN to help prevent fraudulent tax filings
Because a Social Security number cannot simply be replaced the way a password or credit card can, the exposed information could remain useful to criminals for years after the breach itself fades from the news. Experts note that free credit monitoring typically lasts only 12 months, while the risk from a stolen Social Security number or birth date can persist far longer, so continued vigilance after that period ends is advised.
You must be logged in to post a comment Login