Pentagon Data Breach Exposes 3 Million as FBI Hack Deepens

Two personnel breaches, back to back

Within days of each other, two of Washington's most security-conscious institutions have had to admit that the personal records of their own people were exposed. At the Defense Department, unauthorized users had access to files at the Defense Manpower Data Center (DMDC) for roughly nine months before anyone noticed 2. At the FBI, a criminal group called ShinyHunters says it stole sensitive data on bureau personnel and has threatened to publish it 1.

The timing has prompted speculation that the agencies were targeted in a coordinated way. The public record so far does not support that. The FBI intrusion has a claimed perpetrator and a stated motive. The Pentagon incident has neither. Officials have not said who accessed the DMDC files or exactly which files were taken 5. These look less like a single campaign than two symptoms of the same underlying weakness: federal agencies hold vast amounts of personnel data and often struggle to see when someone is in it.

What happened at the Pentagon

According to a breach notification letter signed by DMDC Director Katie Griffin, unauthorized access ran from October 2025 until July 16, 2026, when the agency discovered a vulnerability in a file-sharing system 2. Military Times first reported the incident based on a September 18 letter sent to an affected individual 5. The exposed files held unencrypted personal information, including Social Security numbers 2. Other fields included names, dates of birth, contact details and job information 5.

The size of the breach has been reported in different ways. A Pentagon official told TIME that 2.76 million living individuals and 294,000 deceased individuals were affected 5. ABC News reported the same figures 3. That comes to just over 3 million, which matches the "roughly 3 million" in Nextgov/FCW's account 2. An earlier local report put the potential exposure at up to four million personnel 4. The official breakdown looks more reliable, but the gap shows how unsettled the facts were when the story broke.

The affected records are only part of what DMDC holds. The center keeps data on more than 60 million people, including active-duty troops, reservists, civilian employees, retirees and their families 3. A Defense Department representative acknowledged that the exposure could raise national security concerns 3. The department said it had found no misuse of the data as of the letter's release. It is offering affected people up to a year of free credit monitoring through IDX 4. Notifications went out by mail 5.

What happened at the FBI

The bureau's situation may be more volatile. ShinyHunters says it took intimate details about personnel from the FBI's jobs portal 1. An internal memo indicated the bureau believes the hackers may have obtained sensitive information on all of its employees, potentially tens of thousands of current and former staff 1. Nearly a week after the group went public, investigators were still working out how the breach happened and how much was lost. Meanwhile, an uncertain deadline for a leak hung over the bureau 1.

The group has framed the attack as retaliation for an FBI warning earlier in the year that ShinyHunters harasses victims and their families 1. That history explains why the New York Times describes fears for employees' physical safety, not just identity theft 1.

Why it matters

The two incidents present different kinds of danger. The FBI breach is loud. A known group is making explicit threats against a workforce that includes agents who investigate violent criminals and foreign intelligence services. The Pentagon breach is quiet, and it may last longer. Nine months of undetected access to unencrypted Social Security numbers is the kind of exposure security experts warn about, because data that sits exposed for that long can be harvested and stockpiled without anyone knowing 2.

Nextgov/FCW notes that the DMDC incident has renewed scrutiny of federal cybersecurity standards, especially agencies' ability to detect unauthorized access to records on millions of people 2. That critique fits both cases. A file-sharing vulnerability went unnoticed for most of a year. A jobs portal apparently gave a criminal group a path to an entire workforce's records. Neither involved an exotic attack on a classified network. Both involved ordinary administrative systems that hold extraordinarily sensitive information.

The takeaway

It is tempting to read the overlap as a coordinated assault, but the evidence points to something more mundane and arguably more worrying: systemic exposure. Personnel databases are attractive targets because they describe exactly who works where, and they are often run with less protection than mission systems. A year of credit monitoring does little against the risks that matter most here, such as foreign intelligence targeting, extortion and harassment of employees and their families. Until agencies can find intruders in months rather than seasons, more letters like DMDC's are likely.