Pentagon Breach Exposed Social Security Numbers of 2.76 Million Personnel

A Pentagon personnel database breach exposed Social Security numbers and employment information for 2.76 million living U.S. military and civilian personnel and 294,000 deceased individuals, a Pentagon official confirmed to Fox News.

Unauthorized users reached unencrypted files in a file-sharing system used by the Defense Manpower Data Center. The access window ran from October 2025 through July 2026. The center discovered the vulnerability on July 16. Affected individuals were notified on Sept. 18. The Pentagon said it has no indication the information was misused.

The files held Social Security numbers and military or civilian employment data. The department has not said who the unauthorized users were, whether the access came from outside the network or from an insider, or how many distinct actors reached the files. It has said the files were unencrypted and that the exposure lasted about nine months before the July 16 discovery.

Notification lagged the discovery by roughly two months. People whose records were in the set were told on Sept. 18, Fox News reported. The confirmation to the network came Sept. 30. Just the News carried the same totals, describing the exposure as more than 2.7 million military and civilian personnel.

The Defense Manpower Data Center is the Pentagon’s central store for personnel numbers. A breach there is not a tactical leak of war plans. It is a bulk release of identity data on people who wear the uniform, work for the department, or did either. Social Security numbers plus employment records are enough for identity theft and for targeting. The department’s statement that it has no indication of misuse is the limit of what it has said. It is not a finding that the files were never copied.

The same week, War Secretary Pete Hegseth used a Quantico address to cut general-and-admiral billets and to open a competition for a new domestic base. The breach notice is separate from those announcements. It concerns a vulnerability that sat open from last fall until mid-July, in a system that should not have been holding Social Security numbers in unencrypted form.