You don't need to be in the military to be hit by this one. You just need a tie to someone who served. Maybe you worked for the Department of Defense. Maybe your parent, spouse, or child did. Even if that person has already passed away, this still touches you.
A Pentagon records system sat open for nine months. Nobody caught it. Inside were Social Security numbers for millions of people. The records had no lock on them at all. Here's what the Pentagon has said, what it still won't say, and what to do if you think you're on the list.
What happened
The Defense Manpower Data Center is called DMDC. It is the Pentagon's own record office. It keeps files on troops, veterans, and DoD workers. It also keeps files on their family members.
Someone broke into a DMDC file system in October 2025. Nobody caught it for months. The Pentagon found the break-in on July 16, 2026, according to Stars and Stripes. That's about nine months of open access. Notice letters did not go out until September 18, 2026. That's two more months of waiting.
A defense official confirmed the breach hit about 2.76 million living people. It also hit 294,000 people who have died. That's per Federal News Network and Cybernews. The data included Social Security numbers. It also had names, birth dates, and job titles. The Pentagon confirmed the data had no lock on it. No password. No encryption.
What it has not said: who broke in. Whether they picked a specific group of people on purpose. Whether this was done on purpose at all. Why Social Security numbers sat with no lock on them in the first place. Those answers are still missing.
Why the deceased numbers matter
Almost 300,000 people on this list have already died. That number matters. A Social Security number does not expire when someone dies. And almost nobody watches credit activity for someone who has passed away. That makes a dead person's number an easier target, not a safer one. If your parent or grandparent served and has passed, their number could still be out there.
What to do if you, or someone in your family, ever served
The Pentagon is offering 12 months of free credit watch through IDX. This goes to people it has confirmed were hit. That's a good start. It is not a full fix. A few more steps close the gaps it leaves open.
- Freeze your credit. Freeze a deceased family member's credit too. It's free at Equifax, Experian, and TransUnion. It's one of the few things that still works for someone who has passed away. Here's how to freeze.
- Sign up for the free credit watch if you get a letter. It won't stop a breach. But it will tell you faster if your number turns up somewhere new.
- Expect scam calls that use this story. Big breaches like this one get used in scams within weeks. If someone calls and says they're "from the Pentagon" or "DMDC support" and asks for your number, hang up. That call is fake. Look up the real number yourself and call that instead. Why this keeps working.
- Keep any letter you get. It's your proof if a lawsuit or payout follows later. Our guide to reading a breach letter shows what to look for.
Government systems are supposed to be safe. This one sat open for almost a year. It held the exact numbers that make identity theft easy. Nothing was locking them down. The Pentagon says it has seen no sign the data was used yet. That's the one good sign here. But watch closely. Don't just trust it.
Want to know if your info has shown up anywhere else?
Our free scan checks known breaches for your email. It shows what else may have leaked with it.
Run the Free Breach Scan →