A notification from the Defense Manpower Data Center (DMDC) confirmed that unauthorized actors accessed U.S. military personnel records for several months, exploiting a vulnerability in an unspecified file-sharing system between October 2025 and mid-July 2026. The breach exposed personally identifiable information, including Social Security numbers, names, dates of birth, sex, race, and service details, with records stored unencrypted. The Pentagon estimates the incident affected approximately 2.8 million living individuals and nearly 300,000 deceased persons. With 1.3 million active service members as of March, the DMDC manages over 60 million records for military and civilian personnel and their families, handling benefits, healthcare, and retirement determinations. The agency describes itself as the military’s primary identity management provider, responsible for safeguarding credentials used to access secure systems and facilities. While the Department of Defense stated it has no evidence of misuse, it did not disclose the basis for that assessment. TechCrunch sought comment from a Pentagon spokesperson regarding contact from the hackers, whose identities remain undisclosed, but received no response. This incident follows a separate breach at the FBI earlier in September, attributed to the ShinyHunters hacking group, which claimed to have obtained data on most of the bureau’s agents and staff, including applicants. The group indicated it would not publish the stolen information publicly. Both breaches reflect a pattern of compromises involving federal personnel records, including the 2015 Office of Personnel Management incident linked to Chinese state-sponsored actors, which exposed records of over 22 million individuals with security clearances. The DMDC’s public statement emphasizes that identity security is paramount to preventing unauthorized access, though specific mitigation steps have not been detailed. Affected individuals were notified via official channels, though the method of notification has not been specified. No public indication suggests the stolen data has been used for malicious purposes, but the incident underscores ongoing vulnerabilities in safeguarding sensitive government records.