A cybersecurity breach at the US Department of Defense has exposed sensitive personal information belonging to more than three million people, including current and former military personnel and civilian employees, a defence official said.
The compromised records affected approximately 2.76 million living individuals and 294,000 deceased persons, according to the official who spoke to ABC News.
The unauthorised access targeted a system maintained by the Defense Manpower Data Center and continued from October 2025 until the vulnerability was discovered and addressed in July 2026.
Exposed data included Social Security numbers, dates of birth, contact details and information about the jobs performed by military and civilian staff. The records were not encrypted, increasing potential risks of identity theft and national security threats.
A US defence official confirmed that a small number of unauthorised users accessed the personally identifiable information during the nine-month period. The agency said it immediately fixed the security vulnerability after discovery on July 16.
National security experts have raised concerns that foreign intelligence services could exploit the data, particularly military occupational specialties that might help identify personnel in sensitive roles.
Defence officials stated there is currently no evidence that the exposed information has been misused. The Pentagon has begun notifying affected individuals and is offering one year of credit monitoring and identity-restoration services.
The identity of those responsible for the breach remains unknown. The incident is separate from a concurrent cybersecurity investigation involving the FBI’s recruitment website, with no established link between the two cases.
