- A Pentagon data breach exposed personal information on 2.76 million living people and 294,000 who have died, a defense official says.
- People who weren't allowed in could open Pentagon personnel files for about 9 months, from October 2025 until July 16, 2026.
- A Pentagon breach letter seen by Military Times says one person's Social Security number and at least one more detail were exposed.
- Defense officials say they've found no sign so far that anyone has misused the data exposed in the Pentagon breach.
- The Defense Department is offering adults hit by the Pentagon breach a free year of credit monitoring from a company called IDX.
A security hole in a Pentagon file-sharing system exposed personal information on 2.76 million living people and 294,000 who have died. ABC News reported those numbers on September 28, citing a defense official. People who weren't allowed in could open the files from October 2025 until July 16, 2026. The files included Social Security numbers and details about the jobs people held.
The official says only a small number of people got in without permission. Neither ABC News nor Military Times says who those people were or how many files they actually opened. On September 24, Military Times reported that two people familiar with the breach said about 4 million Defense Department personnel may be affected. Neither report explains why that's higher than the official's count of about 3 million.
The Defense Manpower Data Center holds more than 60 million Pentagon personnel records and runs the system, which is used for storing and sharing files. The security hole let people without permission open unscrambled files kept on one of the center's computers. The center found the hole on July 16 and fixed it right away, but neither report says exactly what the hole was.
Military Times saw a breach letter dated September 18, and two defense officials confirmed it's real. The letter tells the person who got it that their Social Security number was exposed, along with at least one more detail. That could be a name, birth date, sex, race or military job. Defense officials say they've found no sign so far that the data has been misused.
Military Times breach letter report
The Defense Department is offering affected adults a free year of credit monitoring through IDX, a company it hired. The U.S. Federal Trade Commission says a credit freeze is also free and always a good idea, especially after a data breach. A freeze stops new lenders from checking a person's credit report, which blocks most new accounts in that person's name.
IDX's sign-up page says a freeze is best kept for people who've suffered extreme identity theft, because a freeze locks down a person's credit. But IDX says people with a freeze can still sign up for its monitoring. They only need to lift the freeze briefly to turn the monitoring on, and the FTC says lifting a freeze is free and it can be put back afterward.
