- Pentagon files on about 3 million people were left open for 9 months.
- The files had Social Security numbers and military job details, and weren't encrypted.
- The Pentagon didn't notice until July, and hasn't said who got in.
- People in the files are getting letters offering a free year of credit monitoring.
A few people got access to Pentagon files on about 3 million people, and the Pentagon didn't notice for nine months. The files had Social Security numbers in them. They weren't even encrypted.
ABC News Pentagon breach scope
The files belong to the Defense Manpower Data Center. That's the Pentagon office that keeps records on troops, veterans, civilian workers, contractors and their families. A security hole in the office's file-sharing system let people get to the files. About 294,000 of the 3 million people in them have died.
The Pentagon found the hole on July 16 and says it fixed it right away. When it looked back, it found people had been opening the files since October 2025. Defense officials say they haven't seen anyone misuse the data so far.
Military Times breach letter report
The Pentagon is mailing letters to people in the files. One letter, sent September 18, told the person their Social Security number was exposed, plus at least one more detail. That could be their name, birth date, contact info, sex, race or military job. Security experts worry the job details could tell foreign spies who does what in the military.
If you've served in the military, worked for the Pentagon or are in a military family, keep an eye on your mail. The letter offers a free year of credit monitoring through IDX, a company the Pentagon hired. To sign up, you give your name, address, phone number and email. It doesn't ask for your Social Security number.
IDX DMDC credit monitoring page
You can also freeze your credit. A freeze stops anyone, you included, from opening new credit in your name until you lift it. The FTC says it's free and doesn't hurt your credit score. IDX says freezes are really for people hit by serious identity theft, and you'd have to lift yours for a bit to turn on its monitoring. And the Pentagon still hasn't said who got access to those files.
