Pentagon DMDC Breach Hits 3 Million Personnel Files

The U.S. Defense Manpower Data Center (DMDC) is notifying more than 3 million current and former military service members that attackers accessed the Pentagon’s human resources management system and exfiltrated personnel records, BleepingComputer reports.

DMDC is the Pentagon component that tracks service histories, personnel assignments, and benefits eligibility across all branches.

What was taken

DMDC has characterized the stolen data as “personnel records.” The agency has not confirmed which specific data fields were included. Attribution for the intrusion has not been established in current public reporting.

What affected personnel should do

If you receive a DMDC breach notification:

1. Request your credit reports via AnnualCreditReport.com and look for accounts you did not open.
2. Place a credit freeze at all three major bureaus (Equifax, Experian, TransUnion). It’s free and blocks new credit lines from being opened in your name.
3. Watch for spearphishing attempts that reference your service history, branch, or assignment. Verify any contact claiming to be from DoD, the VA, or a defense contractor before responding.
4. Enroll in any identity protection service included with the breach notification. Previous federal breach notifications have come with free credit monitoring periods.

Context

DMDC holds records for a large share of the U.S. military workforce, active and retired, which makes it a target for intelligence-focused intrusions. The 2014-2015 OPM breach exposed roughly 22 million federal employees and clearance applicants through similar HR system access; whether this incident follows a comparable pattern is not established in current reporting.

The Pentagon had not issued a public statement as of this writing.

For recent breach coverage, see DIVD Breached via Zammad Zero-Day Chain and Bitget Confirms Zero-Day Behind $387.5M Crypto Theft.