Pentagon data breach exposes records of over 3M people
You can change a password after a breach. You can cancel a credit card. But when your Social Security number gets exposed, you could be dealing with the fallout for years. That is the concern after a major breach involving the Pentagon's Defense Manpower Data Center. If you have served in the military, worked for the Department of War or have other ties to the military community, your information could be among the records involved.
A War Department official told CyberGuy that 2.76 million living individuals and 294,000 deceased individuals were affected. Depending on the person, the exposed information can include Social Security numbers, names, dates of birth, contact information and military personnel details. So, if a breach letter from the Pentagon shows up in your mailbox, don't toss it aside. Here's what happened, what may have been exposed and what you can do to protect yourself.
DMV BREACH CONFIRMED AS HACKERS CLAIM 200,000 RECORDS STOLEN
Join us for a free CyberGuy LIVE class.
Kurt "CyberGuy" Knutsson shares practical ways to stay safer, smarter and more confident with technology. Explore classes on stopping spam, phone security, financial protection and using AI to get better healthcare. Each class is free, easy to follow and comes with a free printable checklist.
See the classes and register at CyberGuyLive.com
The breach involved the Defense Manpower Data Center, or DMDC. A War Department official told CyberGuy that a DMDC information system experienced unauthorized access to personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. The official said DMDC immediately remediated the vulnerability after discovering it. At this time, the department says it has no indication that the accessed information has been misused.
The files accessed contained unencrypted personally identifiable information. That created a potentially long exposure window before the vulnerability was discovered. Personal information such as a Social Security number can remain useful to criminals long after the original breach fades from the headlines.
The specific information varies depending on the person. According to the Pentagon, exposed records can include:
The military details make this breach particularly sensitive because the records may reveal more than basic identity information. DMDC plays a major role behind the scenes at the Department of Defense. It maintains more than 60 million records covering military personnel, civilian employees, contractors, family members, retirees and veterans. The agency uses those records to support benefits, identity verification and other Defense Department programs. In other words, plenty of people who left active military service years ago may still have information stored in these systems.
People whose personal information was accessed are being notified by postal mail through the Department's contracted provider, Identity Theft Guard Solutions, or IDX. If you receive a notice, read it carefully rather than assuming it is another piece of junk mail. The letter should explain what information tied to you was affected and what protection is being offered.
According to the War Department official, IDX is providing notification, credit monitoring and identity restoration support based on the data elements affected for each individual. Anyone with questions can visit response.idx.us/DMDC or call 1-855-744-4556.
Be careful with unexpected emails or text messages claiming to be connected to the breach. Scammers can use major security incidents as an excuse to send fake notices or links designed to steal even more information. Instead of clicking a link in an unexpected message, verify the information using the official IDX contact details or the postal notice you received.
WHY SCAMMERS TARGET VETERANS AND HOW TO FIGHT BACK
A credit card number has an expiration date. Your Social Security number usually stays with you for life. That can give criminals plenty of time to combine stolen information from one breach with information collected elsewhere. Someone might already have your phone number or an old email address. Adding a Social Security number and date of birth can make a stolen identity far more useful.
A criminal could try to open credit in your name or use the information in a convincing phishing attack. Other forms of identity fraud may never involve your credit report at all. That is why I would treat a breach involving an SSN differently from one exposing an email address or password.
A breach notice can leave you wondering where to start, so focus first on the protections that can limit what someone does with the information.
If DMDC sent you an official notification, review the identity protection services available to you. Eligible individuals may receive 12 months of free credit monitoring and identity restoration support through IDX, depending on the information affected. Credit monitoring can warn you about certain changes to your credit file. However, monitoring usually alerts you after activity occurs. It does not stop someone from attempting to use your identity.
If you were not contacted by DMDC, or if you want protection that continues beyond the free 12-month period, you may also want to consider a broader identity theft protection service. Depending on the service, it may monitor for suspicious use of your personal information and provide help if identity theft occurs. See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.
Consider placing a credit freeze with Equifax, Experian and TransUnion. A freeze restricts access to your credit file, which can make it harder for someone to open a new credit account in your name. You can temporarily lift the freeze when you legitimately need to apply for credit. A freeze remains one of the strongest free steps you can take after your Social Security number has been exposed. Keep in mind that a freeze focuses on new credit. It cannot stop every type of identity theft, including fraud involving an existing account.
If you do not want to freeze your credit, you can place a fraud alert on your credit reports. A fraud alert tells lenders to take extra steps to verify your identity before opening new credit. You only need to contact one of the three major credit bureaus, and that bureau should notify the other two. A fraud alert offers less protection than a freeze, but it can still add another layer of scrutiny.
Review your bank and credit card activity regularly. Also pay attention to unexpected changes involving accounts that use your identity. Turn on transaction alerts where available. Quick warnings can help you spot activity before it grows into a bigger problem.
Scammers pay attention to major data breaches too. You could receive a call, email or text from someone claiming to represent the Defense Department, a credit monitoring company or another organization offering to help you secure your identity.
Do not hand over a Social Security number, password or verification code because someone contacts you unexpectedly. Also avoid opening attachments or clicking links in unexpected breach-related messages.
Strong antivirus software can help detect malicious downloads, suspicious links and other threats that may show up in follow-up scams. Keep your security software updated and verify unexpected requests using official contact information you find yourself. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
Turn on two-factor authentication (2FA) for your email, financial accounts and other important services whenever it is available. Your email account deserves special attention because criminals can use it to reset passwords for other accounts. An authenticator app or passkey can offer stronger protection than relying only on a password.
If your Social Security number was exposed, consider getting an IRS Identity Protection PIN. An IP PIN is a six-digit number that helps prevent someone else from filing a federal tax return using your Social Security number. The IRS issues a new PIN each year. This can be especially useful after a breach because tax-related identity theft may not show up on a credit report.
One year of free monitoring is useful, but stolen personal information does not become harmless when that year expires. Continue checking your credit reports and financial accounts. Also pay attention to unexpected tax notices, benefit claims or bills that you do not recognize. We have previously explained why a credit freeze alone does not stop every form of identity theft. A stolen Social Security number can potentially be misused in ways that never trigger a traditional credit check.
What stands out to me here is how long the information involved can remain valuable. A password can be replaced in a few minutes, but a Social Security number, birth date or military history can follow you for decades. If you receive one of these Pentagon breach notices, I would take it seriously even though officials say they have not seen evidence of misuse. Use the free monitoring being offered and consider freezing your credit. Then keep an eye on your accounts after that free monitoring period ends. We hand organizations an enormous amount of personal information because we often have no practical alternative. When that information gets exposed, the burden of watching for fraud suddenly falls back on us.
If the government loses information as sensitive as your Social Security number, should it be responsible for protecting your identity for longer than one year? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.