Loading story…
Unauthorized users exploited a vulnerability in the Defense Manpower Data Center's file-sharing system, accessing unencrypted personnel files from about October 2025 until the flaw was detected on July 16, 2026. The breach may affect roughly 4 million current and former Department of Defense personnel. Exposed information reportedly includes names, dates of birth, contact and demographic data, unencrypted Social Security numbers, and in some cases military occupational specialty or equivalent role codes.
DMDC remediated the vulnerability and restored the affected system, detecting and containing the intrusion in July before notifying individuals on September 18. It offered 12 months of IDX credit-monitoring and identity-restoration services; no malicious use had been reported at publication. The incident has not been attributed, and the exploited vulnerability has not been disclosed, but the combination of identity data and military-role information creates substantial identity-fraud and counterintelligence risk, potentially enabling adversaries to identify and target service members, veterans, and their families.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
DMDC sent breach notifications to affected individuals and offered 12 months of credit monitoring and identity-restoration services through IDX. At the time reported, no malicious use of the exposed data had been identified.
DMDC discovered the vulnerability that enabled the intrusion, patched it, and restored the affected system. The Pentagon reportedly detected and remediated the intrusion after approximately nine months of unauthorized access.
Unauthorized users began accessing a vulnerable DMDC file-sharing server containing unencrypted personnel information. The access reportedly exposed personally identifiable information, including Social Security numbers and military occupational data, affecting potentially about four million people.
The FBI separately warned employees of a breach involving its FBIJobs.gov portal. ShinyHunters claimed responsibility and threatened to publish staff information, including Social Security numbers.
The Department of Defense confirmed that the DMDC breach affected 2.76 million living individuals and 294,000 deceased individuals. The responsible actor remained unidentified, and the Pentagon reported no indication that the exposed data had been misused.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
25 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcearstechnica.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcemalware.news
Open sourceedition.cnn.com
Open sourcereddit.com
Open sourceirs.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A breach at the Pentagon’s Defense Manpower Data Center (DMDC) exposed unencrypted personnel information through unauthorized access lasting from October 2025 until July 16, 2026, when the agency discovered a vulnerability in a file-sharing system. A defense official said the incident affected **2.76 million living people and 294,000 deceased individuals**. Exposed information included Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties. DMDC patched the vulnerability, restored the system and offered affected individuals one year of credit monitoring and identity-restoration services. Security experts warned that the months-long exposure could enable fraud, targeted deception and identification of government personnel of interest to foreign intelligence services. The incident renewed scrutiny of Pentagon cybersecurity standards and highlighted the need for stronger access monitoring and tested incident-response plans.
Oct 5, 2026
The District of Columbia Department of Health Care Finance (DHCF) disclosed that two publicly accessible web reports exposed underlying personal data for 399,086 DC Medicaid and DC Healthcare Alliance beneficiaries enrolled from 2023 to 2026. Although the reports displayed aggregate enrollment and statistical information, hidden data may have been available to unauthorized visitors from 2023 until the agency identified the issue on July 21, 2026. The exposed fields included Medicaid IDs, dates of birth, provider names, race, gender, ethnicity, and ward; the agency said names, Social Security numbers, and financial-account information were not included. DHCF said the incident was not a cyberattack and that it has found no evidence of access or misuse, but removed the reports, began an internal review and system checks, notified affected individuals, and reported the exposure to the US Department of Health and Human Services.
Sep 28, 2026
The UK Ministry of Defence disclosed that a malign actor accessed part of an armed forces payment network operated by an external contractor, exposing personal data for serving personnel, reservists, and some recently retired veterans. The compromised records included names and bank details and, in a smaller number of cases, home addresses; reporting also cited National Insurance numbers among the exposed information. The affected platform was described as separate from the MoD’s core network and main military HR systems, and the government said no operational defence data was obtained. The MoD took the contractor-run system offline, halted payment processing on that platform, opened a full investigation, and began notifying affected individuals while offering helplines, monitoring, welfare, and financial support. Ministers said they could not rule out state involvement and were examining potential failings by the contractor that may have enabled the intrusion, while broader commentary on the incident highlighted the supply-chain risk posed by third-party service providers, the possibility that attackers remained undetected for weeks, and the heightened personal safety risks that exposed military identities and locations can create, including fraud, harassment, blackmail, and targeting.
Jun 29, 2026