The living make up about 90% of those exposed, or 2.76 million people, and the rest are dead; their files include Social Security numbers and job details. Officials say there is no evidence yet that the data has been misused.
Key figures
- Access ran from October 2025 to July 2026, about nine months.
- The DMDC found the flaw on July 16, 2026, and patched it that month.
- The exposed files are about 5% of the more than 60 million personnel records the DMDC holds in total.