You can change a password in a minute. You can cancel a card in five.
You can't change your Social Security number.
The Pentagon just confirmed a breach at the Defense Manpower Data Center (DMDC), the office that keeps personnel records for the military community. It affected 2.76 million living people and 294,000 people who have died. If you've served, worked for the department, or are connected to someone who has, your records could be in there.
What happened
From October 2025 to July 2026, a small number of unauthorized users got into a DMDC system that held personal information. The files were unencrypted, so the access went unnoticed for about nine months.
The department says it fixed the vulnerability as soon as it found it. It also says it has no sign so far that the data has been misused.
"So far" carries a lot of weight in that sentence.
What got out
It depends on the person. Exposed records can include:
- Social Security numbers
- Names and dates of birth
- Contact information
- Sex and race
- Military personnel details, including occupational specialty
DMDC holds more than 60 million records on service members, civilian staff, contractors, families, retirees and veterans. So even if you left the military decades ago, your file probably didn't.
Why this one hits harder
A leaked password stops working once you change it. A leaked SSN keeps working for the rest of your life.
Criminals don't need everything from one breach. They combine pieces. Your old email came from one leak, your phone number is on a data broker's site, and now they have your SSN and birth date. Put together, that's a usable identity, and some fraud done with it never appears on your credit report.
Am I affected?
Affected people are being notified by postal mail through the department's contractor, IDX (Identity Theft Guard Solutions). If you get a letter, open it and read it.
- Official site: response.idx.us/DMDC
- Phone: 1-855-744-4556
Watch for fake notices. Scammers use big breaches as cover. If you get an unexpected email or text "about the Pentagon breach," don't click anything. Go to the official site or the letter yourself.
What to do now, in priority order
- Freeze your credit at Equifax, Experian and TransUnion. It's free, and it's the strongest step you can take. You can lift it whenever you need to apply for credit.
- Get an IRS Identity Protection PIN. It blocks someone from filing a tax return with your SSN, a kind of fraud your credit report won't catch.
- Enroll in the free monitoring if your letter offers it. Eligible people get up to 12 months. Keep in mind that monitoring alerts you after something happens; it doesn't prevent it.
- Turn on two-factor authentication, starting with your email. Whoever controls your inbox can reset almost everything else.
- Set transaction alerts on your bank and card accounts.
- Keep watching after month 12. Your data stays valuable to criminals long after the free monitoring ends.
The bigger point
You didn't choose to hand over this data. You needed benefits, a paycheck or an ID card, and there wasn't any other way. Then, when the data leaks, you're the one who has to watch for fraud.
That's backwards. Your data is yours, so you should be able to see where it's exposed and get it out of places it shouldn't be.
That's what Reklaim Protect is for. It's free. It watches your email for breaches and tells you when you show up in one. It can also help you get your personal information removed from data brokers, which leaves criminals fewer pieces to combine with a stolen SSN.
It can't un-leak a government file. Nothing can. It can make the rest of your data harder to use against you.
Source: Fox News / CyberGuy Report, "Pentagon data breach exposes records of over 3M people," October 12, 2026.