Pentagon DMDC military data breach lawsuit (Edwards v. Department of War)

Two Marines, one serving and one former, have sued the U.S. Department of Defense over a breach at the Defense Manpower Data Center (DMDC), the Pentagon office that keeps personnel records for service members, veterans, retirees, civilian staff and their families. The case is Edwards v. United States Department of War, No. 1:26-cv-03667, filed October 20, 2026, in the U.S. District Court for the District of Columbia.

The proposed class covers everyone whose personal information was accessed in the breach. A Pentagon official told Federal News Network that the breach affected about 2.76 million living people and 294,000 deceased people. The complaint brings one claim under the federal Privacy Act. No court has ruled, no class has been certified and there is no settlement.

The defendant is the Department of Defense. A September 5, 2025 executive order authorized "Department of War" as a secondary name, and the complaint sues under that name. According to the complaint, DMDC collects personnel, manpower, training and financial data, held more than 60 million records as of fiscal year 2024 and oversees identity verification for department ID card holders.

Tristyn Edwards lives in California. The complaint says he enlisted in the Marine Corps around September 2023 and must keep a security clearance for his work. Morgan Stampfli lives in New York and served in the Marine Corps from 2010 to 2021.

The plaintiffs are represented by Migliaccio & Rathod LLP, including Nicholas A. Migliaccio and Jason S. Rathod. The public docket we checked did not show an assigned judge as of October 22, 2026.

The department's notice letter, quoted in the complaint, says a security vulnerability in a DMDC file sharing system was discovered on July 16, 2026, and that DMDC patched it and restored the system. The letter says that "between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII."

The exposed data varies by person. According to the letter, each person's records included a Social Security number and at least one more identifier, such as name, date of birth, contact information, sex, race or military personnel information like occupational specialty.

The complaint says letters went out in mid-September 2026, and both plaintiffs received theirs on September 18. Military Times first reported the breach on September 24. On September 28, a Pentagon official gave Federal News Network the count of 2.76 million living and 294,000 deceased people, about 3.05 million in total. The letter offers 12 months of credit monitoring through IDX.

Edwards says that on or about August 20, 2026, before he got his letter, his debit card was hit with fraudulent charges totaling $317.91, including one at a people-search site called PeopleFinder. Stampfli says that days after his letter, someone used his Navy Federal Credit Union debit card for a $271.19 order from KaTom Restaurant Supply, shipped to an Illinois address he did not recognize.

The complaint claims the department violated the Privacy Act's requirement that agencies keep "appropriate administrative, technical, and physical safeguards" for records about individuals. It says the department stored Social Security numbers without encryption, missed the intrusion for about nine months and took about two more months after discovery to send notices. It cites Defense Department Inspector General reports, including one stating that the department's information security program "remained ineffective for the last 5 years."

It calls the department's conduct willful and intentional. That matters because the Privacy Act ties money damages to that finding.

Edwards adds that, because of his clearance, common protective steps such as freezing his credit are not available to him.

The department's letter says it "does not have any indications of misuse of the accessed information" and that DMDC "immediately initiated privacy and cybersecurity incident response actions." Class Action Pulse found no public statement from the department about the lawsuit, and no response appeared on the docket as of October 22, 2026.

Nothing has been decided. The complaint was filed two days before this article. The court has not ruled on whether the department violated the Privacy Act, whether it acted willfully, whether the plaintiffs' fraudulent charges are linked to the breach or whether any class should be certified. Under the federal rules, a U.S. agency generally has 60 days after service to answer or move to dismiss.

The proposed class is "all natural persons whose PII was accessed without authorization as a result of the Data Breach discovered on July 16, 2026, and recognized by DOW on September 28, 2026."

• The department and its agents, officers and directors, including their family members, are excluded.
• Judicial officers presiding over the case and their staff are excluded.
• The definition turns on whose information was accessed. It does not mention receiving a letter, and it does not require proof of fraud.

• Enroll in the free IDX monitoring at response.idx.us/DMDC with the code in your letter, or call 1-855-744-4556. MeriTalk reported that the enrollment deadline is August 19, 2027.
• Review bank and card statements, and check your credit reports for accounts you did not open.
• Consider a free fraud alert or credit freeze with Equifax, Experian and TransUnion. If you hold a security clearance, check with your security office first.
• Keep the notice letter and records of any fraudulent charges, replaced cards and time spent dealing with them.

No money is available from the lawsuit. The complaint seeks actual and statutory damages, attorney fees, costs and interest, and its opening paragraph also mentions injunctive relief. These are requests, not awards.

The Privacy Act limits money awards. Under 5 U.S.C. 552a(g)(4), the government pays only if the court finds the agency acted "intentional or willful," and then pays actual damages, with no person receiving "less than the sum of $1,000," plus costs and fees. The IDX monitoring is a separate benefit available now.

• October 2025: Unauthorized access begins, according to the notice letter.
• July 16, 2026: DMDC discovers and patches the vulnerability.
• August 20, 2026: Edwards reports fraudulent debit charges.
• September 18, 2026: Both plaintiffs receive notice letters.
• September 24, 2026: Military Times reports the breach.
• September 28, 2026: A Pentagon official gives the affected counts.
• October 20, 2026: The complaint is filed.
• August 19, 2027: Reported IDX enrollment deadline.

The lawsuit has no claim, opt-out or objection deadlines. The Privacy Act says a suit must be brought "within two years from the date on which the cause of action arises," with a narrow exception.

• DMDC: The Defense Manpower Data Center, which keeps personnel and identity records for the Defense Department.
• Privacy Act of 1974: The federal law that governs how agencies collect, keep and protect records about individuals.
• PII: Personally identifiable information, such as a name paired with a Social Security number.
• Class certification: A court order allowing a few plaintiffs to sue for a larger group.

The government must be served and then answer or move to dismiss. A motion to dismiss could challenge whether the plaintiffs can show harm caused by the breach and whether the Privacy Act claim is stated properly.

This article relies on the complaint, the court docket, reporting by Federal News Network, Military Times and MeriTalk, the IDX response site, the Privacy Act and the executive order.

The notice letter text comes from the complaint, not from a letter we obtained. The security failures, willfulness and the link between the breach and the plaintiffs' fraud are allegations. The affected counts come from a Pentagon official quoted in news reports; the department has not published a detailed breach report. The enrollment deadline is reported by MeriTalk and did not appear on the IDX page we could read. The docket view comes from a public archive and may not show every filing.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.