Service members, veterans and others whose records were exposed in the 2025–2026 Defense Manpower Data Center breach may be covered by a proposed class action alleging the Defense Department violated the Privacy Act by failing to protect their personal information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. The Defense Department has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Two Marines, one serving and one former, filed a proposed class action on October 20, 2026 in the U.S. District Court for the District of Columbia over the Defense Manpower Data Center (DMDC) breach. The case is Edwards v. United States Department of War, No. 1:26-cv-03667. The Defense Department has used the secondary name Department of War since 2025, and the suit names it under that title.DMDC is the Defense Department office that keeps personnel records for the military community. The department has said an outside party exploited a weakness in a DMDC file-sharing system and reached unencrypted files on a server between October 2025 and July 16, 2026. According to Law360, the suit accuses the department of taking nearly nine months to discover the breach and seeks to represent the roughly 3 million people whose information was exposed. The department has not responded in court, and the claims are unproven.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Breach
Military Times first reported the breach on September 24, 2026, based on a notification letter dated September 18 that two defense officials confirmed was authentic. According to the letter, DMDC found a security vulnerability in its file-sharing system on July 16, 2026, patched it and restored the system, and a later review found unauthorized access to files on a server going back to October 2025.The exposed files held unencrypted personal information, including Social Security numbers plus at least one other identifier, such as name, date of birth, contact information, sex, race, or military personnel data such as occupational specialty. A defense official later put the total at about 2.76 million living people and 294,000 deceased people. The letter says the department has no indication the information has been misused.
The department is offering one year of credit monitoring and identity protection through IDX, a company it contracted to handle the response. Enrollment runs through the IDX site named in the letter.
What the Lawsuit Claims
The suit is brought under the Privacy Act of 1974, which governs how federal agencies keep records about individuals and requires them to maintain safeguards for those records. The Act lets a person sue the government for an intentional or willful violation that causes actual damages, with a minimum recovery of $1,000 per person plus attorneys' fees, which makes it the usual vehicle when a federal agency, rather than a company, suffers a breach.According to published reports, the plaintiffs allege the department failed to detect the unauthorized access for months and did not notify affected people until September 2026, and one plaintiff reports fraudulent charges on a debit card before receiving the notice letter. Whether the breach caused those charges has not been established. The plaintiffs are represented by Migliaccio & Rathod.
What Happens Next
The government has not yet responded to the complaint. The case is at the complaint stage, so there is no settlement, claim form or deadline. A Privacy Act case requires proof of actual damages to recover money, which tends to make these cases slower and harder to resolve than breach suits against private companies.The breach letter and the IDX credit monitoring offer are separate from the lawsuit and do not depend on it. Service members dealing with other financial protections tied to military service can find background in the Servicemembers Civil Relief Act explainer.
Questions
What information was exposed in the Pentagon DMDC data breach?
According to the Defense Department's notice letter as reported by Military Times, the affected files held unencrypted personal information including Social Security numbers plus at least one other identifier, such as name, date of birth, contact information, sex, race, or military personnel data such as occupational specialty.
How many people were affected by the DMDC breach?
A defense official put the total at about 2.76 million living people and 294,000 deceased people, roughly 3.05 million records in all. Earlier reports, citing people familiar with the incident, estimated about 4 million.
Is the Pentagon offering credit monitoring after the DMDC breach?
Yes. The Defense Manpower Data Center is offering 12 months of credit monitoring and identity protection services through IDX, a company contracted by the department. Enrollment instructions are in the notice letter dated September 18, 2026 and on the IDX enrollment site for the DMDC incident.
Is there a DMDC data breach settlement to claim?
No. The lawsuit was filed on October 20, 2026 and is at the complaint stage. No class has been certified, and there is no settlement, claim form or deadline.
What law does the DMDC lawsuit rely on?
The suit is brought under the Privacy Act of 1974, the federal law that governs how federal agencies keep records about individuals. Under the Act, a person can recover damages from the government for an intentional or willful violation that causes actual damages, with a minimum recovery of $1,000, plus attorneys' fees.
Sources
- Court docket, Edwards v. United States Department of War, No. 1:26-cv-03667 (D.D.C. filed October 20, 2026)
- Law360 — "Marines Sue DOD Over Data Breach Affecting 3M People," October 21, 2026
- Military Times — first report on the breach and the September 18, 2026 notice letter, September 24, 2026
- Stars and Stripes — report on the number of people affected, September 29, 2026
- IDX enrollment site for the Defense Manpower Data Center incident (checked October 21, 2026)
- Privacy Act of 1974, 5 U.S.C. § 552a
