Loading story…
A breach at the Pentagon’s Defense Manpower Data Center (DMDC) exposed unencrypted personnel information through unauthorized access lasting from October 2025 until July 16, 2026, when the agency discovered a vulnerability in a file-sharing system. A defense official said the incident affected 2.76 million living people and 294,000 deceased individuals. Exposed information included Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties.
DMDC patched the vulnerability, restored the system and offered affected individuals one year of credit monitoring and identity-restoration services. Security experts warned that the months-long exposure could enable fraud, targeted deception and identification of government personnel of interest to foreign intelligence services. The incident renewed scrutiny of Pentagon cybersecurity standards and highlighted the need for stronger access monitoring and tested incident-response plans.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Military Times first reported the DMDC incident in late September 2026, citing the breach notification signed by Katie Griffin.
On July 16, 2026, DMDC discovered a vulnerability in its file-sharing system after roughly nine months of unauthorized access. The agency said it immediately initiated privacy and cybersecurity incident-response actions under federal and Defense Department guidelines.
Unauthorized access to the Defense Manpower Data Center’s file-sharing system began in October 2025 and continued until July 16, 2026. The breach exposed unencrypted personnel information affecting approximately 3 million people, including Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties.
Two people familiar with the incident told Military Times that approximately four million Defense Department personnel may be affected by the DMDC breach. The scope remained unconfirmed, and the Defense Department and DMDC did not immediately respond to questions about the affected population.
A breach notification signed by DMDC Director Katie Griffin described the unauthorized access and exposed personal information. Affected individuals were offered one year of credit monitoring and identity-restoration services.
DMDC patched the file-sharing vulnerability and restored the affected system, according to its breach notification letter. The letter did not specify when those remediation actions occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourcemilitarytimes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Unauthorized users exploited a vulnerability in the Defense Manpower Data Center's file-sharing system, accessing unencrypted personnel files from about October 2025 until the flaw was detected on July 16, 2026. The breach may affect roughly 4 million current and former Department of Defense personnel. Exposed information reportedly includes names, dates of birth, contact and demographic data, unencrypted Social Security numbers, and in some cases military occupational specialty or equivalent role codes. DMDC remediated the vulnerability and restored the affected system, detecting and containing the intrusion in July before notifying individuals on September 18. It offered 12 months of IDX credit-monitoring and identity-restoration services; no malicious use had been reported at publication. The incident has not been attributed, and the exploited vulnerability has not been disclosed, but the combination of identity data and military-role information creates substantial identity-fraud and counterintelligence risk, potentially enabling adversaries to identify and target service members, veterans, and their families.
Oct 2, 2026
Hackers tied by multiple reports to China penetrated the U.S. Office of Personnel Management and accessed some of the government’s most sensitive personnel systems, including databases linked to federal employee records and the `e-QIP` security-clearance platform. What was first described in 2014 as a detected intrusion later emerged as one of the most damaging breaches of U.S. government networks: authorities said the attackers compromised records on **22.1 million people**, including current and former federal workers, contractors, applicants, and others connected to background investigations. The stolen data included Social Security numbers, health and financial details, background-investigation forms, and **5.6 million fingerprints**, raising fears that the information could be used to build long-term intelligence dossiers on U.S. personnel. The breach triggered resignations, congressional scrutiny, and years of criticism over OPM’s security failures. OPM Director Katherine Archuleta resigned after the scale of the compromise became clear, and CIO Donna Seymour later stepped down amid pressure from lawmakers and investigators. Reports said the intrusion was discovered during a security product demonstration, while watchdogs accused OPM officials of obstructing parts of the investigation and the Government Accountability Office later found that dozens of recommended fixes remained incomplete years after the attack, including weaknesses around passwords, shared administrative accounts, and contractor oversight.
Jun 29, 2026
The District of Columbia Department of Health Care Finance (DHCF) disclosed that two publicly accessible web reports exposed underlying personal data for 399,086 DC Medicaid and DC Healthcare Alliance beneficiaries enrolled from 2023 to 2026. Although the reports displayed aggregate enrollment and statistical information, hidden data may have been available to unauthorized visitors from 2023 until the agency identified the issue on July 21, 2026. The exposed fields included Medicaid IDs, dates of birth, provider names, race, gender, ethnicity, and ward; the agency said names, Social Security numbers, and financial-account information were not included. DHCF said the incident was not a cyberattack and that it has found no evidence of access or misuse, but removed the reports, began an internal review and system checks, notified affected individuals, and reported the exposure to the US Department of Health and Human Services.
Sep 28, 2026