Hackers stole millions of US military records in months-long breach

The U.S. government is reportedly notifying millions of current and former U.S. military service members and staff that their personal information was stolen in a months-long breach of the Pentagon’s personnel records — the latest in a string of thefts involving federal workers’ data in recent months.

A data breach notification from the Defense Manpower Data Center (DMDC), shared on Reddit, says several unauthorized users exploited a security vulnerability in an unspecified file-sharing system over several months, between October 2025 and mid-July 2026. The exposed data included Social Security numbers, names, dates of birth, sex, race, and other military-service information; the notice says the personnel records were unencrypted. According to CNN and Federal News Network, a Pentagon official said the breach affects about 2.8 million living people and close to 300,000 people who are deceased.

The DMDC isn’t widely known to the public, but it’s one of the Department of Defense’s records-keeping units, maintaining more than 60 million records used to determine benefits like healthcare and retirement, and serving as the military’s identity-management provider linking personnel to the credentials used to access Pentagon systems, buildings, and bases. The Department of Defense, which oversees the DMDC, said it has no indication the stolen information was misused, though it didn’t say how it reached that conclusion. The identities of the hackers are not known, and a Pentagon spokesperson didn’t respond to TechCrunch’s questions about whether officials had heard from them.

This is the latest major breach of federal workers’ data in recent months, following a breach at the FBI earlier in September attributed to the hacking group ShinyHunters, which told TechCrunch it had taken the personal information of most of the FBI’s agents and staffers, including applicants — a breach that’s been called a “counterintelligence disaster” given the risk that a foreign government could use the data to profile, target, or coerce federal workers. ShinyHunters has said it won’t publicly release the stolen FBI data. Both incidents echo a 2015 breach at the Office of Personnel Management, broadly attributed to China, that exposed the private records of more than 22 million U.S. government employees, many with security clearances.

Why it matters

Repeated breaches of federal personnel data raise the stakes beyond identity theft: records tying military and intelligence personnel to their roles, clearances, and credentials are exactly the kind of information a foreign intelligence service could use to target or pressure individuals with access to sensitive systems.