US DMDC / Pentagon personnel records: ~3.05M people — file-share PII exposure Oct 2025–Jul 2026 (letter 18 Sep)
SecurityWeek (29 September 2026), citing a Defense Manpower Data Center (DMDC) notification letter dated 18 September and a Department of War official speaking to CNN, reports that unauthorized users accessed a DMDC file-sharing server holding unencrypted PII for roughly nine months. DMDC says a security vulnerability in the file-sharing system was discovered 16 July 2026, patched immediately, and the system restored; analysis found unauthorized access between October 2025 and discovery. Exposed data varied by person and included Social Security numbers, names, dates of birth, contact details, demographic data, and military occupational specialties. Scope per DoW official to CNN: about 2.76 million living individuals and 294,000 deceased (~3.05M). Letter does not name the file-sharing product or CVE; DMDC says no indications of misuse of accessed information at time of notice; no public claim of responsibility reported. DMDC holds personnel records for DoD military/civilian/contractor/family/retiree populations. Wire-primary until a mil/DoD public advisory URL is mirrored. Distinct from desk astrana-health-8k-20260922 and shinyhunters-fbi-peoplesoft-20260922.
- Product
- US Defense Manpower Data Center (DMDC) file-sharing system (product unnamed)
- Versions
- n/a — vulnerability discovered 16 Jul 2026 and patched same day per DMDC letter; unauthorized access window Oct 2025–discovery
- Exploited in Australia?
- unknown
- Patch to
- No public product CVE/patch path named. Affected individuals: follow DMDC notification guidance (credit monitoring / fraud watch on SSN). Defence/gov HR operators: treat file-share and collaboration platforms as high-value PII stores — patch promptly, encrypt at rest, restrict anonymous/guest links, monitor for long-dwell unauthorized access. Prefer primary mil/DoD notice when published.
Primary: SecurityWeek — Pentagon / DMDC personnel agency breach ~3M (29 Sep 2026) · Vendor: CNN — Pentagon personnel data breach / DoW scope figures (25 Sep 2026) · Public recipient discussion of DMDC notification letter (dated 18 Sep 2026)