Massive Pentagon hack sees records of 2.7 million US military personnel leaked during months-long data breach — names, military service records and Social Security numbers all revealed

• October 1, 2026

• Breach exposed PII of three million current and former DoD-affiliated individuals
• Attackers accessed unencrypted data for months via vulnerable file-sharing system
• Stolen records included SSNs, military roles, and sensitive personnel details

Three million people, both living and deceased, who either work and used to work for a division of the US Department of War (DoW, also known as the DoD), have had their personally identifiable information (PII) stolen in a cyberattack that went on undetected for months.

The Department of War runs a component called the Defense Manpower Data Center (DMDC). It is the DoD’s personnel-data agency that collects and maintains personnel and workforce data. It manages large databases with information about military personnel, civilian employees, contractors, and other individuals connected to the US defense community.

The DMDC also provides data and analytical services to support military operations.

Breach confirmed

Roughly two weeks ago, a person shared a photograph on Reddit, showing a data breach notification letter they received in their mail. In the letter, the DMDC explained what happened, and offered complementary identity theft monitoring services:

“On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files,” the letter reads. “DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored.”

A subsequent investigation determined that someone used the flaw to access servers containing unencrypted PII in October 2025. Between then, and July 2026, they were extracting all sorts of information, including Social Security numbers (SSN), full names, dates of birth, contact information, sex, race, and military personnel information such as occupational specialty.

Speaking to CNN, an official of the Department of War confirmed the breach, saying it affects 2.76 million “living individuals”, and 294,000 deceased ones. According to the DMDC website, the organization handles more than 60 million records.

At press time, we were still missing key details. We don’t know which file sharing system was targeted, or what the flaw is. Just a few days ago, secure file-sharing service Kiteworks warned its customers to shut down their servers for nine hours, in anticipation of an incoming cyberattack.

Links to Kiteworks?

Kiteworks is a large secure file-sharing service that works with government agencies, including US federal, state, and local governments. On its website, the company explicitly says that defense contractors use its platform to protect CUI and FCI that they exchange with the DoD, although it does not confirm working directly with the agency. Kiteworks also markets dedicated government solutions and says its platform is FedRAMP authorized for federal use.

Cybercriminals such as Cl0p are known for targeting this type of service. A few years ago, major breaches at MOVEit and GoAnywhere MFT resulted in data leaks in thousands of organizations. The damage is in the millions.

Further in the letter, the DoW says there are so far “no indications” of the files being misused, although it is safe to assume the files will either be sold on the black market, or used for highly tailored phishing emails. The attackers could use the information to trick victims into sharing login credentials, ultimately accessing even more sensitive DoW servers and causing even further damage.

CNN says the “occupational specialty” information could be extremely valuable to foreign nation-state threat actors, because it can be combined with Social Security numbers to get a “clearer read on who does what for the US military in various parts of the world.”

The DMDC said it patched the flaw as soon as it discovered it, so it’s safe to assume this wasn’t a zero-day. Besides “taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system,” the agency also said it was now offering 12 months of credit monitoring services through IDX.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Breach exposed PII of three million current and former DoD-affiliated individuals Attackers accessed unencrypted data for months via vulnerable file-sharing system Stolen records included SSNs, military roles, and sensitive personnel details Three million people, both living and deceased, who either work and used to work for a division of the…