A breach of a Defense Department personnel-data system potentially exposed information about roughly 3 million people for about nine months, making the duration of unauthorized access a central security concern. The exposure ran from October 2025 through July 16, 2026, at the Defense Manpower Data Center, according to Defense One.

The compromised system was a file-sharing platform used by the Defense Manpower Data Center, which maintains personnel information for the military and other government agencies. The files contained unencrypted personal information. Depending on the individual, that information included Social Security numbers, names, birth dates, contact information and military occupational specialties.

The roughly 3 million figure describes people whose information was potentially exposed. It does not establish how many individuals’ data attackers used or whether the information was involved in a subsequent fraud campaign, espionage operation or other intrusion. The notification and reporting on the incident describe potential exposure over the period before the vulnerability was discovered.

The length of the access period is significant because the records remained potentially available from October 2025 until July 16, 2026. The incident account does not describe an immediate system outage or other visible disruption. Instead, the vulnerability was discovered after unauthorized access had continued for months, according to Defense One.

Nitay Milner, co-founder and CEO of data security company ORION Security, identified the delay as the primary warning. “Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning,” he said, as quoted by Defense One.

The incident notice was signed by DMDC Director Katie Griffin. Griffin wrote that, after the vulnerability was discovered, the center began privacy and cybersecurity incident-response actions under Office of Management and Budget and Defense Department guidelines and policies. The center patched the flaw and restored the system, the notice said. It also said the agency was assessing and enhancing the system’s cybersecurity posture.

Affected individuals are being offered one year of credit-monitoring and identity-restoration services. The notice identifies those services as part of the response for people whose information may have been exposed. The services do not change the period during which the files were potentially accessible or establish how the information may have been used.

The exposed records included several categories of personal information that can be combined to identify individuals. Social Security numbers, names, birth dates and contact information were available in the files, depending on the person. The presence of multiple categories of information increases the sensitivity of the records, even though the breach account does not establish that attackers used them after gaining access.

Defense One reported that the information could help attackers identify government personnel and tailor attempts to deceive them through fraud schemes. It also reported that the data could identify employees whose work is of particular interest to foreign intelligence services. Those are potential consequences of the exposed information, not findings that the data was used in a particular operation.

No public evidence has linked the DMDC incident to a separate breach claimed by the cybercrime group ShinyHunters, Defense One reported. The two incidents involve different disclosures, and the available account does not establish a shared intrusion or common cause.

Milner said effective detection requires agencies to examine who is collecting sensitive information, whether that activity is authorized and whether it makes sense in context. That approach focuses on activity within a system rather than only on whether the system has stopped functioning. The DMDC incident illustrates the importance of that distinction: access to sensitive files continued for months before the vulnerability was discovered.

Jeff Wichman, senior director of breach preparedness and response at Semperis, said agencies need plans that account for intrusions even when they have experienced security teams and established protections. He described resilience as a pressure-tested incident-response plan that assigns responsibilities across discovery, containment, legal requirements and regulatory reporting.

The DMDC incident therefore has two distinct dimensions. The first is the scale of the potentially affected population, which the notification put at roughly 3 million people. The second is the period of unauthorized access, which lasted about nine months. The available reporting establishes potential exposure and the agency’s response after discovery, while leaving the extent of any later use of the information unresolved.