Washington: Personal information belonging to nearly 3 million people has been exposed in a breach of a Pentagon personnel database, including Social Security numbers and details about the jobs held by military and civilian personnel, according to media reports.

The breach affected 2.76 million living individuals, and another 294,000 deceased people, a US defence official said. The compromised information included sensitive employment details that could potentially be used to identify or profile military personnel.

"A Defence Manpower Data Centre (DMDC) information system experienced unauthorised access of personally identifiable information by a small number of unauthorised users between October 2025 and July 2026. Upon discovery, DMDC immediately remediated the vulnerability," the defence official said.

The unauthorised access took place between October 2025 and July 2026, when the vulnerability was discovered and addressed. Defence officials said they had found no evidence so far that the exposed information had been misused.

The Defence Manpower Data Centre (DMDC), one of the Pentagon's primary repositories of personnel records, holds information on active-duty and reserve military personnel, civilian employees, contractors, retirees, veterans and military families. The agency maintains more than 60 million personnel records.

The centre is offering affected individuals identity protection and credit monitoring services as it works to assess the breach and strengthen the security of its systems.

Occupational details, Social Security numbers exposed

The breach involved a vulnerable computer server belonging to the DMDC, CNN reported, citing a letter sent by the centre to affected individuals.

According to the letter reviewed by CNN, one category of information accessed in some cases was the "occupational speciality" of military service members. The data was not encrypted, the report said.

The Pentagon currently "does not have any indications of misuse" of the compromised information, according to the letter.

However, cybersecurity experts have warned that the exposed records could be combined with other datasets to identify military personnel, facilitate phishing attacks or support intelligence-gathering efforts.

Justin Sherman, CEO of advisory firm Global Cyber Strategies, told CNN that access to such information could enable profiling, phishing and foreign intelligence approaches if acquired by a foreign adversary.

It remains unclear who was behind the breach. A Pentagon spokesperson did not immediately respond to CNN's questions about the culprit.

The DMDC said it was taking appropriate measures to assess and enhance the cybersecurity of its systems. Affected individuals are being offered one year of credit monitoring services.

FBI also investigates separate data breach

The Pentagon incident comes amid a separate breach involving the FBI's recruitment website, FBIJobs.gov.

An unidentified threat actor had threatened to publish information about FBI employees, including names, home addresses, personal and work contact details, Social Security numbers, dates of birth and emergency contact information, sources told ABC News.

The FBI is operating on the assumption that the personal information of every employee was compromised, according to the report.

The hacking group "shinyhunters" later told The New York Times and 404 Media that it would not release the data as previously threatened. ABC News said it had not independently verified the group's claims.

The two incidents have raised concerns about the exposure of sensitive personal information held by US government agencies.

The DMDC website describes the centre as a central access point for information related to Department of Defense benefits, entitlements and medical readiness for military personnel, veterans and their families.