Hackers have stolen the personnel records of millions of military service members through a breach of a Pentagon server that lasted eight months.
The Defense Department notified service members of the hack in a letter dated Sept. 18. The letter, since posted on social media, says the hackers obtained a wide range of personally identifiable information, such as Social Security numbers, names, dates of birth, contact information, sex, race and military personnel information such as occupational speciality.
Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™
Point phone camera here
The breach underscores the vulnerability of sensitive data at federal agencies, including those that oversee vital national security functions. A similar hack of FBI personnel files recently exposed data on current and former agents, their spouses and applicants to the bureau.
More than 3 million affected
The breach began in October 2025 after “a small number of unauthorized users” exploited a vulnerable server run by the Defense Manpower Data Center, or DMDC, an agency under the Defense Department that stores records on more than 60 million people, including those in the military and their families as well as contractors, retirees and veterans.
The hackers, who have not been publicly identified, retained access to the server, where the sensitive data was stored in an unencrypted format, until July 2026 when the DMDC identified and patched the vulnerability.
“DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of Management and Budget at department guidelines and policies,” the letter said. “We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system.”
In a statement to CNN, a Defense Department official said that the breach affected 2.76 million “living individuals” and an additional 294,000 “deceased individuals.”
The Pentagon also said it had no current evidence suggesting that the data has been misused. The data, if obtained by those with malicious intent, could pose a risk to national security and be used to track or extort military personnel.
The announcement comes days after the cybercrime group ShinyHunters breached the FBI and reportedly obtained between two and three terabytes of highly sensitive information on nearly “all FBI employees and applicants.”
While ShinyHunters told Straight Arrow it will not release the data to the public, a sample containing information on 5,000 FBI personnel, including those in the bureau’s secretive hacking unit, has already begun to spread.
Round out your reading
- Lawyer says 57 Cornell frat members were in the group chat. Could their silence be a crime?
- Florida county discovers mysterious Flock cameras with no obvious owner.
- Off Script: They won their primaries on one message. Now it’s disappearing.
- Some question whether a popular affordable housing policy is making the nation’s home shortage worse.
- Kelvin wave incoming: Why the US should care.
