A cyber attack lasting several months exposed personal information on about 3.05 million people at the Defence Manpower Data Center (DMDC), an agency under the U.S. Department of War (Department of Defense).

TechRadar, an IT media outlet, reported on Oct. 1 local time that those affected include 2.76 million living individuals and 294,000 deceased. DMDC manages personnel information related to the U.S. Department of War, including active-duty and reserve troops, civilian employees, contractor employees, veterans and military family members, and holds more than 60 million records.

The breach came to light after a security vulnerability was found on July 16 in DMDC’s file-sharing system. The Department of War said a small number of unauthorised users accessed the system from October 2025 to July this year. DMDC updated the system immediately after confirming the vulnerability to fix the issue.

The problem was that personal information was stored on the server without encryption. The exposed data varies by individual but includes Social Security numbers (SSNs) as well as names, dates of birth, contact details, gender and race. For military personnel and civilian employees, it was also confirmed that the data included job information that could identify military occupations and assigned duties.

In particular, the exposure of military job information together with Social Security numbers has raised the possibility it could lead to security risks beyond a simple personal data breach. The Department of War said it has not found evidence so far that the exposed information was actually misused.

The product name of the file-sharing system used in the attack, details of the vulnerability and the attackers’ identities were not disclosed. DMDC is reviewing and strengthening the system’s cybersecurity framework, while providing affected individuals with 12 months of free credit monitoring and identity protection services through IDX.