A hack of Pentagon workers information went unnoticed for 9 months, exposing 3 million individuals

TL; DR: The Pentagon’s workers information system was accessed for approximately 9 months before authorities found and covered the vulnerability, which exposed personally recognizable info connected to more than 3 million individuals. It included an especially delicate mix of information: Social Security numbers and details about the tasks held by military and civilian workers– a pairing that raises threats beyond traditional identity theft.

The afflicted system was run by the Defense Manpower Data Center (DMDC), which handles workers records throughout the military and much of the Defense Department’s civilian labor force.

The Defense Department stated the occurrence impacted 2.76 million living individuals and another 294,000 who are deceased. DMDC holds more than 60 million workers records, consisting of records for active-duty soldiers, reservists, civilian workers, professionals, senior citizens, veterans and military member of the family.

“A Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. Upon discovery, DMDC immediately remediated the vulnerability,” a defense authorities stated.

The declaration leaves numerous significant concerns unanswered. The department has actually not stated how the burglars entered the system, what vulnerability they utilized, just how much information they saw or copied, or how the activity went unnoticed from October 2025 till July 2026. It likewise has actually not openly called a group or nation accountable for the invasion.

The period of the gain access to is most likely to draw attention. Big workers databases are developed to share info throughout a company, typically with lots of users, systems and administrative functions included. That makes them helpful for handling payroll, advantages, preparedness and labor force records. It can likewise make them challenging to protect. A defect in one system can expose information coming from lots of groups simultaneously.

DMDC’s function makes it a particularly appealing target. The company sits at the center of a broad network of military workers info. Its records cover individuals presently serving, individuals who previously served, civilian employees and member of the family. A breach in such a system can produce threats that continue long after the technical concern is repaired, especially when irreversible identifiers such as Social Security numbers are included.

Defense authorities stated they have actually not discovered proof that the info has actually been misused. They are providing identity-protection and credit-monitoring services to individuals impacted by the breach. An absence of verified abuse does not indicate the details is no longer at danger. Information can be maintained, traded or integrated with other product long after an invasion ends up being public.

The Pentagon case comes quickly after the FBI divulged a different breach including FBIJobs.gov, its work site. The bureau has actually informed staff members it is dealing with the matter as if individual info coming from all FBI staff members might have been jeopardized. The FBI stated the afflicted system was unclassified and cautioned staff members to be alert for suspicious calls.

Hacking group ShinyHunters later on stated it would not launch FBI-related information it had actually declared to have. “Since the very beginning of this event we have unequivocally and assiduously emphasised this is NOT extortion, this is NOT ransom, this is NOT financially motivated,” the group stated. “This was all a marketing campaign to protect our business and actively combat disinformation. If we made this statement normally then this much attention to our words and intentions would’ve never been this widespread.”

ABC News stated it had actually not individually confirmed the group’s claims.

For the Pentagon, covering the vulnerability was just the primary step. The bigger problem is whether the department can identify what took place throughout the nine-month duration of unapproved gain access to and whether the information was copied or utilized somewhere else.