CNN (25 September 2026, 4:18 pm US Eastern; 26 September, 4:18 am Perth) reports that a data breach at the Pentagon's HR system exposed Social Security numbers and other personal information of current and former military personnel.

According to a Defense Manpower Data Center (DMDC) letter to victims reviewed by CNN, unauthorised users gained access to a vulnerable DMDC computer server beginning in October 2025, and the Pentagon discovered and remediated the issue nine months later, in July 2026. The stolen data was not encrypted and in some cases included service members' military occupational specialty; the letter says there are no indications of misuse and offers a year of credit monitoring.

It is unclear who was behind the breach. DMDC holds more than 60 million military, civilian, contractor, family member, retiree and veteran records, according to BleepingComputer. Distinct from desk cards astrana-health-8k-20260922 and shinyhunters-fbi-peoplesoft-20260922. Primary: CNN; wire: BleepingComputer.

Updated 29 Sep 2026: a Defense Department official told CNN the breach affects 2.76 million living individuals and 294,000 deceased individuals. (source: CNN)

Updated 1 Oct 2026: BleepingComputer (5:44 pm Perth) reports that DMDC's notification letters, shared online by affected people, say a small number of unauthorised users had access to their data between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems; the data varies by person and includes Social Security numbers, names, dates of birth, contact information, sex, race and military personnel information.

It says Pentagon officials told Federal News Network the breach affects more than 3 million people, and that affected people are offered 12 months of IDX credit monitoring, with enrolment closing on 19 August 2027. (source: BleepingComputer)

Correction (25 Oct 2026): the card date has moved from 29 to 26 September 2026 (Perth time), the date of CNN's first report, and the card now rests on CNN and BleepingComputer; details only a wire report we cannot verify gave (a letter date of 18 September and a discovery date of 16 July) have been removed. (source: CNN)