DMDC Notification Letters

Notification letters dated 18 September 2026 told recipients that a vulnerability in a Defense Manpower Data Center file-sharing system had allowed unauthorized users to access files containing unencrypted personal information between October 2025 and 16 July 2026.

The incident became public on 24 September, when Military Times reported one of those letters. The wider disclosure covering roughly three million people followed at the end of the month. This entry covers the notification itself, which is a distinct event from the breach and is examined separately here for that reason.

The letters describe unencrypted personal information. Subsequent reporting established the categories as Social Security numbers, names, dates of birth, contact details and military personnel information.

Unencrypted is the operative word and it is the agency's own. Files containing identity data for service members sat in a file-sharing system in a form that required no key to read, which means the vulnerability granted not just access but comprehension.

Service members, civilian staff and their families, who learned by post. For a population trained to treat its own personal details as operationally sensitive, a mailed letter is both the legally correct channel and a slow one.

Recipients also had better information than the public for six days, which is an unusual inversion. The people affected knew before the institutions reporting on it did, and one of them passing a letter to a journalist is how it entered the record.

Written notification to affected individuals is the legal standard and the agency met it. Letters dated 18 September, following a 16 July discovery, is roughly two months and within normal federal practice.

The design question sits further back. A file-sharing system in front of a personnel database is the sort of convenience component that gets attached without the scrutiny the database itself receives, and encryption at rest on those files would have made the same vulnerability far less consequential.

That the files were unencrypted, and that they were reachable. Those are two separate failures and the letter concedes both.

Encryption at rest is usually described as a control against theft of storage media. Its real value is exactly this case: a flaw grants access to files, and what the intruder gets depends entirely on whether the contents were readable. Nobody had asked which files in that share held identity data and whether any of it was protected.

The nine-month access window means the question went unexamined for nine months while the answer was being collected by somebody else.

No actor has been named publicly. Officials describe a small number of unauthorized users, which is a careful phrase that distinguishes this from mass exploitation without identifying who.

The absence of extortion across nine months of access points to collection rather than crime, and that reading is consistent with the nature of the data.

Encryption at rest on the files in the share. The vulnerability was patched within a day of discovery. Had the contents been encrypted, the same flaw would have produced a far smaller letter.

Second, knowing what sat in that share. The notification describes files containing unencrypted personal information, which means somebody eventually enumerated them. Doing that before October 2025 would have prompted the obvious question about why identity data for three million people was sitting readable in a file-sharing system at all.