What should I do if my data was in the Pentagon breach?

Hackers sat undetected inside the Pentagon's personnel file system for nine months, stealing SSNs on about 3 million people. Take the free credit monitoring, then freeze your credit at all three bureaus.

Hackers sat undetected inside the Pentagon’s DMDC file-sharing system from October 2025 to July 2026 — nine months — stealing records on roughly 2.76 million living service members, Defense Department staff, family members and veterans, plus about 294,000 records of deceased individuals. The exposed data reportedly includes Social Security numbers — and stolen SSNs, even of the deceased, fuel identity theft for years. Even if you have no military connection, the playbook is the same for any major breach.

Step one: if you received a notification letter, follow its instructions and take the free credit monitoring being offered. Step two: freeze your credit at all three bureaus (Equifax, Experian, TransUnion) — it is free, does not hurt your score, and blocks new accounts being opened in your name; you can lift it temporarily when you apply for credit. Step three: file your taxes early and consider an IRS Identity Protection PIN, since stolen SSNs fuel tax fraud.

Step four: watch for phishing — breach victims get targeted with fake “breach assistance” emails and calls, and the real Pentagon will never ask for your full SSN or banking details by phone to “verify” your notification.