Marines file class action over Pentagon DMDC data breach of 3 million records

Estimated reading time: 10 minutes.

Key facts

What happened: On October 20, 2026, two Marines filed a proposed class action in federal court in Washington, D.C., over the breach of a Pentagon personnel data system that exposed Social Security numbers and other records of about 3 million people.
Who is suing: Tristyn Edwards, an active-duty Marine from California, and Morgan Stampfli, a Marine veteran from New York.
Who is being sued: The U.S. Department of War, the name the administration now uses for the Department of Defense. The breached system belongs to its Defense Manpower Data Center (DMDC).
The breach: According to the government's notice letters, a security flaw in a DMDC file-sharing system let a "small number of unauthorized users" open files containing unencrypted personal information from October 2025 until the flaw was found on July 16, 2026.
How many people: A Pentagon official told reporters the breach affected about 2.76 million living people and 294,000 people who have died.
Nothing to claim yet: There is no settlement or claim form. The government's offer of 12 months of free credit monitoring through IDX is separate from the lawsuit.
The case: Edwards v. United States Department of War, No. 1:26-cv-03667, U.S. District Court for the District of Columbia.

What the lawsuit claims

The complaint says the Department of War failed to protect the personal information of service members, veterans, civilian staff and others connected to the military, and then waited too long to tell them it had been exposed.

Its central claims are:

The data was not encrypted. The government's own notice letter says the files sat "on a server containing unencrypted PII." PII stands for personally identifiable information, meaning details such as a name or Social Security number that can identify a specific person.
The intrusion went unnoticed for about nine months. Unauthorized access began in October 2025, and the flaw was not discovered until July 16, 2026. The complaint argues that sustained access for that long shows the department was not reviewing its system logs, even though its own policy requires system owners to check audit logs for suspicious activity at least weekly.
Notice came about two months after discovery. The plaintiffs say they did not receive letters until September 18, 2026, and that the department has not explained either delay.
The notice left out basic facts. According to the complaint, the letter did not identify which system was breached, how the intruders got in, whether files were copied out, or how many people were affected.
The department had been warned. The complaint quotes the department's inspector general, an internal watchdog office, which reported in July 2026 that the department's overall information security program "remained ineffective for the last 5 years" under federal reporting standards. It also points to earlier audits that criticized security at the Defense Enrollment Eligibility Reporting System, a DMDC database.

These are the plaintiffs' allegations. The court has not ruled on them, and the department had not filed a response as of October 22, 2026.

What the Defense Manpower Data Center does

The Defense Manpower Data Center is the part of the military that keeps personnel records. According to the complaint, which quotes DMDC's own description, it collects "personnel, manpower, training, financial, and other data" to track the history of military personnel and their families "for purposes of healthcare, retirement funding, and other administrative needs."

DMDC runs several systems that most people connected to the military interact with, often without knowing the name:

DEERS, the Defense Enrollment Eligibility Reporting System, which the complaint, quoting government records, describes as the "authoritative eligibility and enrollment repository" for military, civilian, retiree and family member data. It supports access to benefits such as commissary and exchange shopping.
ID card systems, including the Common Access Card, the smart card that service members and many civilian employees use to enter bases and log in to military computers.
Personnel record systems that track enlistments, promotions and assignments.

Federal News Network reported that DMDC holds records on more than 60 million troops, veterans, current and former civilian employees, contractors and military family members. That is why a breach there can reach people who left the service years ago, as well as relatives of service members.

Check whether you received a DMDC letter The government says affected people were notified by mail, starting in mid-September 2026. The letter comes from the Defense Manpower Data Center and offers 12 months of credit monitoring through IDX. If you served, worked for the military or are a military family member and are unsure, the IDX contact details below are the official route to ask.

What the government has said about the breach

The notice letter, which the complaint quotes in full in its relevant parts, says that on July 16, 2026, "a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files." It says DMDC "immediately updated the file sharing system to patch the vulnerability."

The letter says the exposed information varies by person but, for the recipient, included a Social Security number and at least one other identifier, such as name, date of birth, contact information, sex, race or military personnel information like occupational specialty. It states that the department "does not have any indications of misuse of the accessed information."

On September 28, 2026, a Pentagon official told Federal News Network that the breach affected nearly 2.8 million living people and 294,000 who are deceased. TIME and Fox News reported the figure as 2.76 million living people, citing a Pentagon official. The official declined to say who accessed the data, whether it was intentional, or why the information was stored unencrypted.

The department is offering 12 months of credit monitoring and identity restoration services through IDX, a data breach response company. A defense official told TIME that people with questions should contact IDX at response.idx.us/DMDC or 1-855-744-4556.

Who is suing

Tristyn Edwards lives in California. He enlisted in the Marine Corps around September 2023 and still serves, according to the complaint. He says he received the breach notice on or around September 18, 2026. Before that, on or about August 20, 2026, he says he found fraudulent charges totaling $317.91 on his debit card, including one that appeared to be a payment to a people-search website. He also says he has received emails warning that his information is on the dark web, the part of the internet where stolen data is often sold. Because he must hold a security clearance, the complaint says, identity theft could affect his career.

Morgan Stampfli lives in New York. He served in the Marine Corps from 2010 to 2021. He also says he received a notice on or around September 18. Days later, according to the complaint, someone used his Navy Federal Credit Union debit card to place a $271.19 order with a restaurant supply company, using his correct name, address, phone number and email but shipping to an address in Illinois he did not recognize. He says his email address was then signed up for a flood of newsletters on September 24 and 25.

The complaint does not prove that these charges came from the DMDC breach. Linking specific fraud to a specific breach is often one of the hardest issues in data breach cases.

The plaintiffs are represented by Jason S. Rathod and Nicholas A. Migliaccio of Migliaccio & Rathod LLP in Washington, D.C.

The Privacy Act claim

The lawsuit makes a single claim under the Privacy Act of 1974, the main federal law governing how U.S. agencies handle records about individuals.

The Privacy Act requires each agency that keeps a "system of records" to "establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records." A system of records is a group of files the agency retrieves by a person's name, Social Security number or other identifier. The complaint argues DMDC's breached files fit that definition, though it acknowledges the government has not named the exact system involved.

The law matters because ordinary data breach claims, such as negligence, are generally hard to bring against the federal government. The Privacy Act gives people a way to sue an agency directly. But it sets a high bar:

Intentional or willful conduct. Money damages are available only if the agency acted in a manner that was "intentional or willful." That is more than carelessness, which is why the complaint repeatedly says the department ignored years of warnings from its inspector general.
Actual damages. The statute provides that a person entitled to recover receives actual damages but "in no case" less than $1,000. Courts have held that people must show some actual financial harm to qualify for that minimum, so the $1,000 figure is not automatic.

The complaint asks the court to certify a class, award actual and statutory damages, and pay attorneys' fees, costs and interest. It also demands a jury trial. It does not state a total dollar amount.

Who the case would cover

The proposed nationwide class is "all natural persons whose PII was accessed without authorization as a result of the Data Breach discovered on July 16, 2026, and recognized by DOW on September 28, 2026."

The department itself, its officers and directors and their families, and the judges assigned to the case are excluded. The plaintiffs reserve the right to change the definition.

No class has been certified. That means no judge has decided whether these two Marines can represent everyone else whose data was exposed. If the case reaches that stage, the court would decide who is included.

Records of deceased service members were exposed too The Pentagon says 294,000 people in the breached files have died. If you manage the affairs of a relative who served and a DMDC letter arrived in their name, keep it, and consider asking the credit bureaus to note the death on that person's credit file.

Timeline

Date	Event
October 2025	Unauthorized access to DMDC files begins, per the government's notice
July 16, 2026	DMDC discovers the file-sharing flaw and patches it
July 20, 2026	Inspector general report says the department's information security program remained ineffective, per the complaint
August 20, 2026	Edwards reports fraudulent debit card charges, per the complaint
September 18, 2026	Both plaintiffs receive DMDC breach notices, per the complaint
September 28, 2026	Pentagon official confirms about 2.8 million living and 294,000 deceased people affected
October 20, 2026	Edwards v. United States Department of War filed in D.C. federal court

What affected people can do now

If you received a DMDC letter. You do not need to do anything to remain a potential member of the proposed class. If a class is certified or the case settles, class members would normally receive formal notice of their options.

Use the free protection that is already offered. The IDX credit monitoring is available now, regardless of the lawsuit. Enrollment instructions are in the letter.

Consider a credit freeze or fraud alert. A freeze stops new credit from being opened in your name and is free at each of the three national credit bureaus, Equifax, Experian and TransUnion. Active-duty service members can also place an active-duty alert and are eligible for free electronic credit monitoring.

Keep records. Save the notice letter, bank and card statements showing any fraud, and receipts for anything you pay to protect yourself. Because Privacy Act damages depend on actual losses, documentation could matter if the case moves forward.

If you want a case you can act on today. See our list of class action cases you can join.

Be cautious with "military breach payout" offers No court has awarded money in this case. Breach notices often trigger scam calls and emails. The government says it contacted affected people by mail, and IDX is the contractor it named. Do not give your Social Security number to anyone who contacts you first about this lawsuit.

What happens next

The case had not been assigned to a judge in the public docket we checked on October 22, 2026. The plaintiffs must formally serve the government. Under federal court rules, a U.S. agency generally has 60 days after the U.S. Attorney is served to answer or file a motion.

Government defendants in data breach cases often move to dismiss early, arguing that plaintiffs lack standing (the legal right to sue because they suffered a concrete injury) or that they cannot show willful conduct or actual damages under the Privacy Act. How the court handles those issues will decide whether the case moves to evidence exchange and, later, class certification.

Other lawsuits over the same breach may also be filed. If that happens, the cases could be combined.

What remains unclear

Who got in and why. The government has not said who the unauthorized users were, whether files were copied, or whether the breach was targeted.
Which system was breached. The notice refers only to a "DMDC file sharing system."
Why notice took two months. The department has not explained the gap between discovery in July and letters in September.
Whether the fraud is connected. The plaintiffs describe fraud and spam they link to the breach, but the government says it has no indication of misuse. The court has made no finding either way.
The exact count. The complaint says about 3.05 million people. Officials gave figures of about 2.76 million to 2.8 million living people plus 294,000 deceased.

This article is for information only and is not legal advice. People with questions about their own records should contact IDX, their service branch or a licensed attorney.

Frequently asked questions

What is the Pentagon data breach class action about?

Two Marines claim the Department of War failed to protect a Defense Manpower Data Center system that exposed Social Security numbers and other records of about 3 million people from October 2025 to July 2026, and then delayed notifying them. They sue under the Privacy Act of 1974.

Who was affected by the DMDC breach?

A Pentagon official said about 2.76 million living people and 294,000 deceased people were affected. DMDC keeps records on service members, veterans, civilian employees, contractors, retirees and military family members. The government says affected people were notified by mail.

What information was exposed?

According to the notice letter, a Social Security number plus at least one other item, such as name, date of birth, contact information, sex, race or military personnel information like occupational specialty. The exact data varies by person.

Is there a settlement or payment?

No. The lawsuit was filed on October 20, 2026, and no court has ruled on it. There is no claim form. The free IDX credit monitoring is a government offer, not a settlement payment.

How much could people get under the Privacy Act?

The law sets a minimum of $1,000 for each person entitled to recover, but courts have required proof of actual financial harm and willful conduct by the agency. Any amount would depend on how the court rules or on a future settlement.

How do I contact IDX about the breach?

A defense official told TIME that people with questions should go to response.idx.us/DMDC or call 1-855-744-4556. Enrollment details are also in the DMDC letter.