The Department of War confirmed that a breach at the Defense Manpower Data Center exposed the personal information of 2.76 million living individuals and 294,000 deceased individuals. A War Department official stated that unauthorized users accessed unencrypted personally identifiable information on a DMDC system between October 2025 and July 2026. The exposed records may include Social Security numbers, names, dates of birth, contact information, and military personnel details. The department reported that it immediately remediated the vulnerability after discovery and currently has no indication that the accessed information has been misused.
DMDC holds a database of more than 60 million entries that span active service members, civilian staff, contractors, family units, retirees, and veterans. These records underpin benefits administration, identity verification, and other Defense Department programs. Because the data includes long-term identifiers such as Social Security numbers, the potential for long-term identity fraud remains a concern even in the absence of confirmed misuse. The unencrypted nature of the files created an exposure window prior to the vulnerability being identified.
Affected individuals are receiving postal mail from Identity Theft Guard Solutions, or IDX, the department's contracted provider. The notifications explain which specific data elements were accessed and outline available protections. IDX is providing credit monitoring and identity restoration support based on the individual data affected. Eligible individuals may receive 12 months of free credit monitoring and identity restoration services. Questions regarding the breach can be directed to response.idx.us/DMDC or by calling 1-855-744-4556.
Recipients of the notice are advised to verify any communication claiming to be related to the breach through official channels to avoid phishing scams. Scammers may exploit major security incidents to distribute fake notices or malicious links. Individuals should not share Social Security numbers, passwords, or verification codes in response to unexpected emails, texts, or calls. Instead, verification should be performed using the official contact details provided in the postal notice or independently located through official government sources.
To mitigate risks associated with exposed Social Security numbers, individuals are encouraged to consider placing a credit freeze with Equifax, Experian, and TransUnion. A credit freeze restricts access to credit files, making it difficult for fraudsters to open new accounts in a victim's name. While a freeze can be temporarily lifted for legitimate credit applications, it does not prevent all forms of identity theft, such as fraud involving existing accounts. Alternatively, a fraud alert can be placed by contacting one major credit bureau, which will notify the other two. This measure requires lenders to take extra verification steps before opening new credit but offers less protection than a freeze.
Additional protective measures include monitoring bank and credit card activity regularly and enabling transaction alerts. Turning on two-factor authentication for email and financial accounts helps prevent unauthorized access that could lead to password resets. Individuals whose Social Security numbers were exposed may also consider requesting an IRS Identity Protection PIN. This six-digit code helps prevent others from filing federal tax returns using the exposed number. Since tax-related identity theft may not appear on credit reports, continued vigilance is necessary beyond the initial 12-month monitoring period.