Loading story…
Unauthorized users exploited a vulnerability in the Defense Manpower Data Center's file-sharing system, accessing unencrypted personnel files from about October 2025 until the flaw was detected on July 16, 2026. The breach may affect roughly 4 million current and former Department of Defense personnel. Exposed information reportedly includes names, dates of birth, contact and demographic data, unencrypted Social Security numbers, and in some cases military occupational specialty or equivalent role codes.
DMDC remediated the vulnerability and restored the affected system, detecting and containing the intrusion in July before notifying individuals on September 18. It offered 12 months of IDX credit-monitoring and identity-restoration services; no malicious use had been reported at publication. The incident has not been attributed, and the exploited vulnerability has not been disclosed, but the combination of identity data and military-role information creates substantial identity-fraud and counterintelligence risk, potentially enabling adversaries to identify and target service members, veterans, and their families.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
DMDC sent breach notifications to affected individuals and offered 12 months of credit monitoring and identity-restoration services through IDX. At the time reported, no malicious use of the exposed data had been identified.
DMDC discovered the vulnerability that enabled the intrusion, patched it, and restored the affected system. The Pentagon reportedly detected and remediated the intrusion after approximately nine months of unauthorized access.
Unauthorized users began accessing a vulnerable DMDC file-sharing server containing unencrypted personnel information. The access reportedly exposed personally identifiable information, including Social Security numbers and military occupational data, affecting potentially about four million people.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecyberveille.ch
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The District of Columbia Department of Health Care Finance (DHCF) disclosed that two publicly accessible web reports exposed underlying personal data for 399,086 DC Medicaid and DC Healthcare Alliance beneficiaries enrolled from 2023 to 2026. Although the reports displayed aggregate enrollment and statistical information, hidden data may have been available to unauthorized visitors from 2023 until the agency identified the issue on July 21, 2026. The exposed fields included Medicaid IDs, dates of birth, provider names, race, gender, ethnicity, and ward; the agency said names, Social Security numbers, and financial-account information were not included. DHCF said the incident was not a cyberattack and that it has found no evidence of access or misuse, but removed the reports, began an internal review and system checks, notified affected individuals, and reported the exposure to the US Department of Health and Human Services.
Sep 28, 2026
The UK Ministry of Defence disclosed that a malign actor accessed part of an armed forces payment network operated by an external contractor, exposing personal data for serving personnel, reservists, and some recently retired veterans. The compromised records included names and bank details and, in a smaller number of cases, home addresses; reporting also cited National Insurance numbers among the exposed information. The affected platform was described as separate from the MoD’s core network and main military HR systems, and the government said no operational defence data was obtained. The MoD took the contractor-run system offline, halted payment processing on that platform, opened a full investigation, and began notifying affected individuals while offering helplines, monitoring, welfare, and financial support. Ministers said they could not rule out state involvement and were examining potential failings by the contractor that may have enabled the intrusion, while broader commentary on the incident highlighted the supply-chain risk posed by third-party service providers, the possibility that attackers remained undetected for weeks, and the heightened personal safety risks that exposed military identities and locations can create, including fraud, harassment, blackmail, and targeting.
Jun 29, 2026
A publicly accessible directory tied to U.S. government contractor **CMI Management Inc.** exposed more than **70,000 files** linked to U.S. military installations and personnel. Reports say the contractor, which provides facility management services to the **U.S. Army**, left records openly available for months through an open directory listing, allowing access to sensitive material including personnel records, contractor documents, maintenance forms, emails, schematics, and photographs taken inside military bases. The leak created risks including **phishing, impersonation, and intelligence gathering** against military facilities and staff. Researcher **Arkadeep Roy** reportedly alerted **CISA** in 2024 after the exposure was identified following a tip to Cybernews, but the files remained accessible as recently as March 2026, underscoring how long-lived misconfigurations at defense contractors can leave operationally sensitive government data exposed.
Jun 29, 2026