A vulnerability in a Defense Manpower Data Center system allowed unauthorized users to access files containing unencrypted personal information, including Social Security numbers and military personnel data, according to a breach notification letter reviewed by Military Times.
DMDC discovered the vulnerability on July 16 in a file-sharing system, according to a notification sent Sept. 18 to an individual whose information was contained in the affected files.
An analysis conducted after the discovery found that unauthorized users had accessed files on a server containing unencrypted personally identifiable information between October 2025 and July 16, 2026.
Two people familiar with the incident told Military Times that approximately four million Defense Department personnel may be affected. The notification letter said a “security vulnerability” in a file-sharing system allowed unauthorized users to gain access.