Pentagon data breach exposes records of more than 3 million people

A Pentagon data breach exposed 2.76 million Social Security numbers and military records, raising long-term identity theft concerns for veterans.

You can change the password after a breach. You can cancel the credit card. But when your Social Security number is leaked, you could be dealing with the consequences for years. The concern comes after a major breach involving the Pentagon's Defense Personnel data center. If you served in the military, worked for the Department of War, or had other ties to the military community, your information could be among the relevant records.

A War Department official told CyberGuy that 2.76 million living and 294,000 deceased were affected. Depending on the individual, the information disclosed could include social security numbers, names, dates of birth, contact information, and military personnel details. So, if a letter from the Pentagon shows up in your mailbox, don't dismiss it. Here's what happened, what you may have been exposed to, and what you can do to protect yourself.

DMV breach confirmed as hackers claim 200,000 records stolen

Kurt "CyberGuy" Knutsson shares practical ways to stay safer, smarter, and more confident in technology. Explore classes on stopping spam, phone security, financial protection, and using artificial intelligence to get better healthcare. Each class is free, easy to follow, and includes a free printable checklist.

View classes and register

The breach involved the Defense Manpower Data Center, or DMDC. A Department of War official told CyberGuy that a DMDC information system experienced unauthorized access to personally identifiable information by a small number of unauthorized users between October 2025 and July 2026. The official said the DMDC immediately patched the vulnerability after discovering it. Currently, the ministry says there is no indication that the information obtained was misused.

Accessed files containing personally identifiable information were not encrypted. This created a potentially long window of exposure before the vulnerability was discovered. Personal information such as Social Security numbers can be useful to criminals long after the original breach has faded from the headlines.

What information was revealed in the breach of the Pentagon

Specific information varies from person to person. According to the Pentagon, leaked records could include:

Military personnel information, including occupational specialties

Military details make this breach particularly sensitive because records may reveal more than basic identity information. DMDC plays an important role behind the scenes in the Ministry of Defence. It holds more than 60 million records of military personnel, civilian employees, contractors, family members, retirees and veterans. The agency uses these records to support benefits, identity verification, and other DoD programs. In other words, many people who left active military service years ago may still have information stored in these systems.

How to Know if the Pentagon Breach Affected You

Individuals whose personal information is obtained will be notified by postal mail through the Department's contracted provider, Identity Theft Guard Solutions, or IDX. If you receive a warning, read it carefully and don't assume it's just another spam email. The letter should explain what information is affected and what protections are provided.

According to the DoD official, IDX provides notification, credit monitoring and identity recovery support based on the data elements that are affected for each individual. Anyone with questions can visit answer.idx.us/DMDC or call 1-855-744-4556.

Be on the lookout for unexpected emails or text messages claiming to be connected to this exploit. Fraudsters can use major security incidents as an excuse to send fake notifications or links designed to steal more information. Instead of clicking a link in an unexpected message, verify the information using the official IDX contact details or the postal notice you received.

Why scammers target veterans and how to fight back

Hackers accessed files containing sensitive personal information, including social security numbers, dates of birth and details of military personnel.

Why do stolen Social Security numbers pose a long-term risk?

The credit card number has an expiration date. Your social security number usually stays with you for life. This can give criminals plenty of time to combine information stolen from a breach with information collected elsewhere. Someone may already have your old phone number or email address. Adding your social security number and date of birth can make a stolen identity much more useful.

A criminal could try to open credit in your name or use the information in a convincing phishing attack. Other forms of identity fraud may never make it onto your credit report. That's why I treat a breach that involves an SSN differently than a breach that exposes an email address or password.

What to do if your information is disclosed

A breach notification can leave you wondering where to start, so first focus on protections that can limit what someone can do with the information.

1) Sign up for free monitoring if you qualify

If DMDC sends you an official notification, check the identity protection services available to you. Eligible individuals may receive 12 months of free credit monitoring and identity recovery support through IDX, depending on the information affected. Credit monitoring can alert you to certain changes in your credit file. However, monitoring usually alerts you after the activity is done. This will not prevent someone from trying to use your identity.

If you haven't been contacted by DMDC, or if you want protection to extend beyond the free 12-month period, you may want to consider a more comprehensive identity theft protection service. Depending on the service, it may monitor for suspicious use of your personal information and assist in the event of identity theft. See my tips and top picks for Best Identity Theft Protection at .

Consider credit freezes with Equifax, Experian and TransUnion. A freeze limits access to your credit file, which can make it harder for someone to open a new credit account in your name. You can temporarily lift the freeze when you legitimately need to apply for credit. Proofing is one of the most powerful free steps you can take after your Social Security number is disclosed. Keep in mind that the freeze is focused on new credit. It cannot prevent any type of identity theft, including existing account fraud.

If you don't want to freeze your credit, you can place a fraud alert on your credit reports. A fraud alert tells lenders to take additional steps to verify your identity before opening new credit. You only need to contact one of the three major credit bureaus, and that bureau must notify the other two. A fraud alert offers less protection than a freeze, but can still add another layer of scrutiny.

Pentagon data breach exposes Social Security numbers, personal information of 2.76 million US military and civilian personnel.

Check your bank and credit card activity regularly. Also, watch out for unexpected changes to accounts that use your identity. Turn on transaction alerts if applicable. Quick alerts can help you spot activity before it becomes a bigger problem.

5) Be suspicious of breach-related messages and use strong anti-virus software

Fraudsters also pay attention to large data breaches. You may receive a call, email, or text message from someone claiming to be a representative of the Department of Defense, a credit monitoring company, or another organization that helps you protect your identity.

Don't give out your Social Security number, password, or verification code because someone is calling you out of the blue. Also, avoid opening attachments or clicking on links in unexpected breach-related messages.

Strong antivirus software can help identify malicious downloads, suspicious links, and other threats that may appear in subsequent scams. Keep your security software up to date and verify unexpected requests using official contact information you find yourself. Get my picks for the best antivirus protection 2026 winners for your Windows, Mac, Android, and iOS devices.

6) Protect important accounts with two-step authentication

Turn on two-factor authentication (2FA) for your email, financial accounts, and other important services whenever available. Your email account deserves special attention because criminals can use it to reset the passwords of other accounts. An authentication program or passkey can provide stronger protection than relying on a password.

If your Social Security number is exposed, get an IRS Identity Protection PIN. An IP PIN is a six-digit number that helps prevent someone else from filing a federal tax return using your Social Security number. The IRS issues a new PIN every year. This can be especially helpful after a breach because tax-related identity theft may not show up on a credit report.

8) Continue watching after free monitoring ends

A year of free monitoring is useful, but stolen personal information isn't harmless once that year expires. Continue to check your credit reports and financial accounts. Also pay attention to unexpected tax notices, interest claims or bills you don't recognize. We've already explained why credential blocking alone won't prevent all forms of identity theft. A stolen Social Security number can potentially be misused in ways that would never trigger a traditional credit check.

What stands out to me here is how long the information can remain valuable. A password can be changed in minutes, but a Social Security number, date of birth or military record can follow you for decades. If you get one of these Pentagon breach notices, I take it seriously, even if officials say they haven't seen evidence of abuse. Take advantage of the free monitoring provided and freeze your credit. Monitor your accounts after the free monitoring period ends. We provide large amounts of personal information to organizations because we often have no practical alternative. When this information is revealed, the burden of fraud prevention suddenly falls on us.

If the government loses sensitive information like your social security number, should it be responsible for protecting your identity for more than a year? Let us know by writing to us.