Hackers stole millions of US military personnel records during months-long data breach

The U.S. authorities is reportedly alerting millions of existent and erstwhile U.S. subject work members and unit that their idiosyncratic accusation was stolen during a months-long breach of the Pentagon’s unit records, the latest successful a spate of thefts involving national workers’ information successful caller months.

A information breach notification from the Defense Manpower Data Center (DMDC) shared connected Reddit says that respective unauthorized users exploited a information vulnerability successful an unspecified file-sharing strategy implicit respective months betwixt October 2025 and mid-July 2026.

The breach exposed personally identifiable information, including Social Security numbers, alongside a person’s name, day of birth, sex, race, and different accusation astir their subject service. The announcement says that the unit records were unencrypted.

According to CNN and Federal News Network, a Pentagon authoritative said the breach affects astir 2.8 cardinal surviving people, and adjacent to 300,000 radical who are deceased.

The U.S. subject has 1.3 cardinal progressive work members arsenic of March.

The DMDC whitethorn not beryllium wide known to the wide public, but serves arsenic 1 of the Department of Defense’s records-keeping units. The DMDC maintains implicit 60 cardinal records for U.S. subject and civilian unit and their household members to assistance find benefits and entitlements, specified arsenic healthcare and retirement. The portion besides provides a captious work arsenic the military’s “leading individuality absorption provider,” which links progressive work members, employees, and contractors to credentials, specified arsenic astute cards and passwords. These are utilized to entree Pentagon machine systems, buildings, and bases.

“We marque definite that the close radical get entree and the incorrect radical don’t: information of individuality accusation is paramount,” the DMDC’s website reads.

The Department of Defense, which oversees the DMDC, said it does not person immoderate denotation that the accusation was misused, but did not accidental however it reached that conclusion. TechCrunch contacted a Pentagon spokesperson to inquire if officials had immoderate communications from the hackers, whose identities are not known, but we did not perceive back.

This is the latest large breach of national workers’ idiosyncratic accusation successful caller months, pursuing a caller breach at the FBI earlier successful September attributed to the ShinyHunters hacking group. The hackers told TechCrunch that they had taken the idiosyncratic accusation of astir of the FBI’s agents and staffers, including applicants. The breach has been billed arsenic a “counterintelligence disaster” amid the risks that a overseas authorities could get and usage the accusation to profile, target, oregon coerce national workers into handing implicit delicate information.

The ShinyHunters hackers person said that they volition not publically merchandise the stolen FBI data.

Both breaches involving the FBI and the DMDC reflector akin thefts of authorities unit records successful the past. In 2015, a breach of the U.S. government’s quality resources department, known arsenic the Office of Personnel Management, was broadly attributed to China. The theft allowed the hackers to bargain the backstage records of much than 22 cardinal U.S. authorities employees, galore of whom had information clearances.

Did you person a announcement astir this information breach? We privation to perceive from you. You tin interaction this newsman securely connected Signal astatine zackwhittaker.1337, oregon scope him by email astatine zack.whittaker@techcrunch.com.