Letters dated September 18 are telling millions of people with ties to the U.S. military that unauthorized users got into a Pentagon personnel system and reached files holding their Social Security numbers. About 2.76 million living people are affected, along with roughly 294,000 who have died, according to FEDweek’s report on the notices.

Affiliate links — we may earn a commission.

What was in the files

The system belongs to the Defense Manpower Data Center, known as DMDC, which FEDweek describes as the department’s main repository for personnel and identity records. The files held unencrypted personal information: names, Social Security numbers, dates of birth, contact information, race, sex and military personnel data, including occupational specialties.

The notice says a “small number of unauthorized users” reached the files between October 2025 and July 2026, and MOAA reports that DMDC discovered the breach on July 16. The database covers military and civilian employees, contractors, family members and veterans, according to a report on the letter, and no source breaks the 2.76 million down by group. Early reporting put the number near 4 million, which is why older stories show a higher count, and ABC News and Federal News Network later cited 2.8 million living people, the same total rounded up. The 294,000 who have died are counted separately, so they do not change the living total in the headline.

The letter lists Social Security numbers among the data taken, so a person who received one has reason to treat the number as exposed. The step that matters most is enrolling in the credit monitoring DMDC is offering, and then deciding what else to lock down before the number can be used.

Names, birthdates and contact details are what a stolen file hands to anyone who can use it, and Incogni sends removal requests to data brokers and people-search sites and keeps re-sending them, which cuts down how much of that personal information is listed there.

The monitoring offer

DMDC is paying for 12 months of credit monitoring through IDX. The enrollment page says the service comes at no cost, that “we do not request your Social Security number to enroll,” and that monitoring alerts a person to any changes to a credit report. The page lists no enrollment deadline. One catch is on the page itself: anyone with a security freeze on file has to lift it temporarily for the monitoring to activate.

MOAA adds that active and reserve service members are also eligible for free monitoring from Equifax, Experian and TransUnion.

What the Pentagon has said, and what it has not

A War Department official told FEDweek that the vulnerability was fixed when it was found and that there are “no indications of misuse.” The official was not named. The Pentagon has not said who got into the files or how, and it has not explained why notices went out roughly two months after the July discovery. FEDweek also notes that DMDC is reviewing separate identity-proofing records for Common Access Card holders, and that the department has not said whether the two matters are connected.

As of September 30, MOAA reported that neither the Pentagon nor DMDC had put out an official news release about the breach.

Shrinking the damage from an exposed Social Security number

The first move is the free one. The IDX enrollment page walks through creating an account, and it also lists the steps the credit bureaus allow without cost: a fraud alert with one bureau, which lasts 90 days and which that bureau passes to the others, and a free credit report from each bureau through AnnualCreditReport.com at 1-877-322-8228. Reports are worth checking for accounts or inquiries a person does not recognize.

A security freeze goes further than a fraud alert. IDX describes it as best suited to people who have experienced serious identity theft, but with a Social Security number sitting in an unencrypted file, some people may judge that it fits their situation. A freeze has to be lifted before IDX monitoring turns on, so the order of the steps matters. Anyone who finds signs of identity theft is told to file a police report and keep a copy, and to contact IDX right away if they are enrolled.

Monitoring watches credit files after something happens. It does not reduce how many places hold a person’s name, address and phone number, and that is a separate job from the credit bureau steps above. Listings on data broker sites are one more place those details can be found, which is the part of the exposure a person can still work on after a breach like this one.

Where the next impostor gets your details

The Pentagon files had names, birthdates and contact information next to Social Security numbers, so the details a thief needs to pose as someone are in the file. Incogni asks data brokers and people-search sites to remove personal information, sends the removal requests on a person’s behalf and keeps re-sending them, with the status of each request shown in an account.

Get your address and phone number off people-search sites with Incogni →

This article was produced with AI assistance and edited for accuracy against the sources linked above.