Unauthorized users accessed the records of millions of military-connected individuals housed in a Defense Manpower Data Center (DMDC) system, according to multiple media reports.

DMDC officials discovered the breach July 16, according to a notice sent to one of the individuals. The notice went out Sept. 18, according to a Military Times report.

Military Times was the first outlet to report the issue, but multiple media reports have followed despite no official news release or statement from the Pentagon or the DMDC as of Sept. 30.

Some details from those reports:

• Size: The initial Military Times report put the number of affected individuals at 4 million. Follow-up reports from ABC News and Federal News Network said the hack affected about a million fewer people – 2.8 million – along with the accounts of 294,000 deceased individuals.
  
  
• Timeline: The notice, posted on the online forum Reddit, says “a small number of unauthorized users” had access to the information from October 2025 until the July discovery. Per the notice, the Pentagon “does not have any indications of misuse of the accessed information.”
  
  
• Data Details: Records may have included full names, birthdates, contact information, Social Security numbers, and military occupational specialty or other military-specific personnel information, according to the notice.
  
  
• Response: DMDC officials are “taking appropriate action to assess and enhance the cybersecurity posture of the DMDC system,” according to the notice. Those affected by the breach can request a year of free credit monitoring service through IDX, a DMDC official told Time magazine. Details on the IDX services appear in the notification.
  
  
• About DMDC: The center serves as the “one, central access point for information and assistance” for servicemembers, veterans, and families on benefits, entitlements, and other programs, according to the DMDC website. It oversees identification card issuance, manages the Defense Enrollment Eligibility Reporting System (DEERS), and fields data requests, among other duties. DMDC held more than 60 million personnel records as of FY 2024, per the DMDC website.
  
  
• Unanswered Questions: It’s unclear who was responsible for the breach, what individuals may have accessed the files, or whether any specific set of records was targeted.

All servicemembers (active and reserve components) are eligible for free credit monitoring services from Equifax, Experian, and TransUnion. Those who believe they may be victims of identity theft can file a report with the Federal Trade Commission.