If you served in the U.S. military, used to, or you’re connected to someone who did, a letter from a company called IDX may already be sitting in your mailbox. It isn’t an ad. It’s notice that your Social Security number may have been exposed on a Pentagon server for the better part of a year.
Unauthorized users had access to the system between October 2025 and July 16, 2026, when the vulnerability was finally found and patched. By the time officials finished counting, the breach reached 2.76 million living people and 294,000 people who have died, more than three million Social Security numbers that sat unprotected the whole time.
A number that size is hard to picture, so here’s the one that actually matters to you. A Social Security number doesn’t expire, and it can’t be swapped out the way a stolen credit card number can. That’s what makes a breach like this one worth taking seriously, whether or not a letter has reached you yet.
What the Defense Department actually lost
The breach hit the Defense Manpower Data Center, the Pentagon’s central record system for more than 60 million military, civilian, contractor, veteran, and family member records. It’s the system behind ID cards, benefits, and the data that determines who gets what from the Department of Defense.
The exposed files sat unencrypted, meaning anyone who got in could read them without needing to crack anything further, from October 2025 until July 16, 2026. Notification letters didn’t start going out until September 18, 2026, nearly two months after the vulnerability was patched.
What was in those files varies by person, but every record exposed included a Social Security number paired with at least one more identifier, things like a name, date of birth, sex, race, home or email contact information, or military occupational specialty.
Why unencrypted data makes this one worse
Most data breaches involve information scrambled behind some form of protection, so a thief still has work to do before a stolen file is usable. That wasn’t the case here. The files sitting on that server were plain text, readable the moment someone got in, for roughly nine months straight.
The occupational specialty detail is its own problem. Knowing what job someone held inside the Department of Defense, paired with their Social Security number and contact information, gives a scammer or a foreign intelligence service far more to work with than a stolen number alone. It’s also exactly the kind of detail that makes a phishing call sound convincing.
Officials say they have no indication the data has been misused, but that statement doesn’t come with an explanation of how they reached it, and it doesn’t rule out misuse down the road. The breach also landed the same month the FBI disclosed a separate break-in at its own recruitment site, a reminder that federal personnel data has had a rough few months.
How to know if your information was part of it
The breach touches a wide group: active duty and reserve troops, veterans, retirees, civilian Department of Defense employees, contractors, military family members, and the families of people who have died. If you fall into any of those categories, you’re in the pool of people who could be affected, whether or not a letter has reached you yet.
Letters started going out from the Department of Defense on September 18, 2026, and they include an enrollment code for credit monitoring. If you haven’t received one, that isn’t proof you’re clear. Letters take time to reach the right address, especially for anyone who’s moved since leaving the service.
If you think you should have gotten a letter and haven’t, don’t wait around for it. The steps below are worth taking whether or not a letter ever shows up, because a Social Security number doesn’t need an official notice to be at risk.
Freeze your credit before anyone else can use it
A credit freeze is free and blocks lenders from accessing your credit report, which makes it much harder for someone to open a new account in your name. It won’t touch your credit score, and it won’t stop you from using cards you already have.
You have to contact all three credit bureaus separately, Equifax, Experian, and TransUnion, since a freeze with one doesn’t cover the others. Each freeze stays in place until you lift it, and lifting it temporarily to apply for new credit is also free.
A fraud alert is a lighter version of the same idea. It doesn’t block access to your credit report, but it tells lenders to verify your identity before opening anything new. A freeze is the stronger option, and given what’s in this breach, it’s worth the fifteen minutes it takes to set one up at each bureau.
Take the year of free credit monitoring if you’re eligible
The Department of Defense is offering 12 months of free credit monitoring and identity restoration through IDX to anyone affected. If you got a letter, it includes the code you need to enroll.
The enrollment window closes on August 19, 2027, which sounds far off until you’re the one who missed it. Put the date somewhere you’ll actually see it again.
Credit monitoring and a credit freeze do two different jobs. A freeze stops new accounts from being opened in the first place. Monitoring watches for activity after the fact and tells you if something slips through anyway. Use both if you can, since neither one covers what the other does.
Get an IRS identity protection PIN
A Social Security number is enough for someone to file a fraudulent tax return in your name and collect a refund before you ever file your own. An IRS identity protection PIN is a six-digit code known only to you and the IRS that stops exactly that.
You request one through an online IRS account, and once it’s set up, a new one becomes available to you automatically every filing season through that same account. It’s one of the few protections here that targets what a stolen Social Security number is most often used for first.
This one is worth doing even if you’re not sure you were part of the breach. It costs nothing, takes a few minutes, and the protection it adds has nothing to do with whether a letter from IDX ever reaches your mailbox.
Check your Social Security account and watch for scam calls
Create or log into a my Social Security account and look over your earnings statement. If someone is using your Social Security number to work under a different name, unfamiliar earnings will usually show up there before anywhere else. If you already collect benefits, you can also ask the Social Security Administration to add an eServices block and a Direct Deposit Fraud Prevention block to your account, which stops anyone, including you, from changing your personal information or direct deposit details online without contacting the agency directly.
If you suspect your information has already been misused, get a free, personalized recovery plan at IdentityTheft.gov, along with a report you can use with banks, credit bureaus, and debt collectors.
Expect scam calls to pick up in the coming months. Someone who knows your rank, your old unit, or your job title can sound a lot more convincing than a random caller claiming to be from the bank. Treat any unexpected call, text, or email that references those details with suspicion, and verify through a number you look up yourself rather than one the caller gives you.
None of this undoes nine months of exposure, but a credit freeze and an IRS PIN together take less than an hour, and that’s exactly the hour most identity thieves are counting on you not spending.
