Served in the military? Your Social Security number may be out there.
A Pentagon personnel system was open to outsiders for about nine months. Letters are going out now. Here's how to lock down your credit before someone else uses it.
What happened
The Defense Manpower Data Center, the Pentagon's main record keeper for military personnel, is mailing breach notices. The letters are dated September 18, 2026. They say a security hole in a file-sharing system let unauthorized users get into files from October 2025 until July 16, 2026, when the problem was found.
The files were not encrypted. According to the letter, exposed data includes Social Security numbers plus at least one other piece of info, like a name, date of birth, contact details, sex, race or military job details. Federal officials put the count at about 2.76 million living people and about 294,000 who have died. The agency keeps records on more than 60 million people, including service members, civilian staff, contractors, family members and veterans.
The Pentagon says it hasn't found any misuse yet. People affected are being offered up to one year of free credit monitoring through IDX.
What it means for you
A Social Security number plus a birth date is the starter kit for opening accounts in your name. Monitoring is nice, but it only tells you after something happens. A freeze stops new credit before it starts.
If a late parent or spouse served, their records may be in there too. Watch for mail in their name.
What to do
- Freeze your credit at Equifax, Experian and TransUnion. You have to contact all three. It's free, it doesn't hurt your score, and it stays on until you lift it.
- Need a loan? Find out which bureau the lender uses and lift the freeze at just that one.
- Add a fraud alert. Contact one bureau and it has to tell the other two. It lasts a year and you can renew it for free.
- On active duty or in the Guard? Ask each bureau for an active duty alert. It also gets you free electronic credit monitoring.
- Did someone call or text offering to "help" with your free monitoring? Hang up. Use only the instructions in your letter.
- If you spot accounts you don't recognize, report them at IdentityTheft.gov.
Want someone to look over your reports with you? Get a free review at credora.co.
Sources
This post is general information, not legal advice. Credora is not a law firm. Results vary and are not guaranteed.
Not sure what's on your report? We'll look at it with you, free. No pressure, no pitch.
Get a free review