DMDC Data Breach Exposes Personal Records of More Than 3 Million People

The U.S. government is notifying millions of current and former military personnel and others that a months-long breach of the Defence Manpower Data Centre, or DMDC, exposed their personal information.

A breach notification shared on Reddit says unauthorised users exploited a vulnerability in an unspecified file-sharing system between October 2025 and mid-July 2026.

The exposed records included personally identifiable information such as Social Security numbers, names, dates of birth, sex, race and details related to military service. According to the notice, the affected personnel records were not encrypted.

More than 3 million records affected

According to CNN and Federal News Network, a Pentagon official said the breach affected about 2.8 million living people and nearly 300,000 deceased individuals.

The DMDC is a Department of Defence records organisation that maintains information used to determine benefits and entitlements for military personnel, civilian employees and their families. It also supports identity management systems that connect service members, employees, and contractors with the credentials needed to access military computer systems, facilities, and bases.

The Department of Defence said it does not indicate the stolen information has been misused, although it did not provide details on how it reached that conclusion.

Federal personnel data remains a high-value target

The breach follows other major incidents involving government personnel information. In September, hackers linked to the ShinyHunters group claimed to have stolen personal information belonging to FBI agents, staff and applicants.

The DMDC incident also recalls the 2015 breach of the Office of Personnel Management, which exposed records of more than 22 million current and former federal employees, including many who held security clearances.

The latest breach again highlights the risks of large repositories of government personnel data, especially when records include sensitive identity information that can remain valuable long after the initial intrusion.