Advisories
DMDC File‑Sharing Server Breach Exposes 3 Million DoD Personnel Records
The Defense Manpower Data Center (DMDC) confirmed that a security flaw in its file‑sharing system allowed unauthorized users to read unencrypted personal data for roughly nine months. The breach, discovered in mid‑July 2026, exposed PII for about 3 million Department of Defense personnel. Defenders should verify DMDC system patches, monitor for suspicious activity, and review access controls on file‑sharing services.
What happened
On July 16, 2026, DMDC identified a vulnerability in its file‑sharing infrastructure that permitted unauthorised access to a server holding unencrypted personnel data. The flaw persisted for about nine months before the system was patched and restored. The breach was discovered in mid‑July and notified to affected individuals on September 18.
Impact
Approximately 3 million DoD personnel records were exposed, including names, social‑security numbers, dates of birth, and other sensitive identifiers. The data was stored in plain text on a file‑sharing server, making it trivially readable by anyone who gained access.
What to do
Defenders should:
- Confirm that DMDC’s file‑sharing system is running the latest patched version.
- Audit access logs for any anomalous activity on file‑sharing services.
- Ensure all PII is encrypted at rest and in transit.
- Implement least‑privilege access controls and multi‑factor authentication for file‑sharing portals.
- Notify stakeholders if any of their data may have been compromised.
"On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored."
Related vulnerabilities
Frontline Education breach exposes school district employee data via third-party software flaw
Frontline Education told school districts that attackers used a vulnerability in a third-party application to access part of its environment and steal employee records, including Social Security numbers. The company identified the issue on August 14, 2026, remediated it, and engaged law enforcement, but has not named the affected product or the initial access date. Districts should treat the incident as a potential PII exposure and begin credential, identity, and monitoring follow-up.
Read briefing
Pentagon Data Breach: Millions of SSNs and Military Records Exposed
The U.S. Department of Defense suffered a breach that exposed Social Security numbers and sensitive military personnel records for millions of individuals. The incident involved a compromised contractor system and highlights the need for stricter access controls, continuous monitoring, and incident response readiness. Defenders should review privileged access, enforce MFA, and conduct forensic analysis.
Read briefing
Astrana Health Discloses Data Breach Stemming from Employee Social Engineering
Astrana Health reported a data breach impacting private and confidential records after attackers used targeted social engineering, including phone number spoofing, to impersonate internal personnel and access company servers. The healthcare management firm has enacted credential rotations, restricted remote access tools, and initiated system restorations from clean backups.
Read briefing
Osaka Metropolitan University Ransomware Attack Halts 500 Servers, Cancels Classes
A suspected ransomware attack disabled 500 servers at Osaka Metropolitan University, shutting down internal network, email, and key academic systems, forcing class cancellations. The incident exposed personal data of ~130,000 users and prompted investigation by external specialists. Defenders should review ransomware defenses, ensure backups, and monitor for similar disruptions.
Read briefing