A vulnerability in a Defense Manpower Data Center system allowed unauthorized users to access files containing unencrypted personal information, including Social Security numbers and military personnel data, according to a breach notification letter reviewed by Military Times.
The Defense Manpower Data Center, or DMDC, discovered the vulnerability on July 16 in a file-sharing system, according to a notification sent Sept. 18 to an individual whose information was contained in the affected files.
An analysis conducted after the discovery found that unauthorized users had accessed files on a server containing unencrypted personally identifiable information, or PII, between October 2025 and July 16, 2026, according to the letter.
The unauthorized users gained access to the Social Security number of the letter’s recipient, as well as at least one additional piece of identifying information, such as a name, date of birth, contact information, sex, race or military personnel information, including occupational specialty, according to the notification.
The notice states that the department had no indication that the individual’s information had been misused.
The potential scope of the breach remains unclear. Two sources familiar with the incident told Military Times that approximately four million Defense Department personnel may be affected.
The department is offering the affected individuals one year of credit monitoring and identity-restoration services through IDX, a private company contracted by the DoD, according to the notice.
DMDC describes itself as the Defense Department’s central source for identifying, authenticating, authorizing and providing information on personnel during and after their affiliation with the department. The agency’s website says it maintains more than 60 million DoD records involving military and civilian personnel, contractors, family members, retirees and veterans.
The notification letter said a “security vulnerability” in a file-sharing system allowed unauthorized users to gain access. The Defense Department and DMDC did not immediately respond to questions about the number of people affected or who accessed the files.
The notification letter says DMDC updated the file-sharing system to patch the vulnerability after discovering the problem and restored the system.
A person familiar with the matter told Military Times that Lt. Gen. Paul Stanton, director of the Defense Information Systems Agency, is taking point on the response and that a broader “cyber hunt” is underway to evaluate Defense Department systems for additional vulnerabilities or unauthorized access.
The DoD had not responded by publication time to questions about a possible broader cyber investigation.
Natalie Oliverio is an independent journalist and Navy veteran who covers military and veterans’ issues. Drawing on her experience as a talent executive and mentor, she writes about the policies, people and programs shaping the military community.