U.S. Department of Defense

Allegations that the Pentagon failed to secure Defense Manpower Data Center records, exposing the personal information of millions of people connected to the U.S. military.

Military members and their families have filed a class action lawsuit against the U.S. Department of Defense after a data breach at the Defense Manpower Data Center (DMDC). Unauthorized users accessed unencrypted files on a DMDC file sharing system between October 2025 and July 16, 2026. The exposed data included Social Security numbers together with at least one other identifier, such as name, date of birth, contact information or military occupational specialty. The Pentagon has said about 2.76 million living people and roughly 294,000 deceased people were affected, and it began sending notification letters in September 2026. The lawsuit alleges the Pentagon ignored known cybersecurity flaws and failed to detect the intrusion for about nine months, and it seeks damages for those affected. No settlement has been reached and there is no claim process yet.

• Current and former service members, civilian employees, contractors, retirees, veterans and military family members whose DMDC records were exposed.
• People who received a DMDC data breach notification letter in or after September 2026.
• Final class definitions will be set by the court.