A notice letter dated September 18, 2026 tells you the Defense Manpower Data Center (DMDC) data breach included your records. If you got one, enroll in the free 12-month credit monitoring, freeze your credit at all three bureaus and watch your pay, bank and Department of Veterans Affairs (VA) accounts.
The lawsuit two Marines filed over the breach is separate from the monitoring offer. It has no claim form, no settlement and no certified class, so there is nothing to claim from it today.
How to Find Out If You Were Affected and What to Do First
The DMDC notice letter dated September 18, 2026 is the first thing to find, because it holds the enrollment instructions for the free credit monitoring. DMDC is the Defense Department office that keeps personnel records for the military community. Take these steps in order.
- Find your notice letter dated September 18, 2026, and keep it somewhere safe. The enrollment instructions for credit monitoring are printed in it.
- Enroll in the 12 months of credit monitoring and identity-restoration services from IDX, the company the Defense Department contracted for the breach response. Use only the instructions in your letter.
- Place a credit freeze at Equifax, Experian and TransUnion. Federal law makes the freeze free, and you have to place it at each bureau separately.
- Pull your free credit reports at annualcreditreport.com, the only federally authorized site for them, and look for accounts you did not open.
- Watch any Defense Finance and Accounting Service (DFAS) myPay, bank and VA.gov accounts you have for direct deposit changes, allotments or charges you did not make.
If you cannot find a letter, you cannot confirm from this page whether your records were included, so take steps 3 to 5 anyway. A freeze and a credit report cost nothing.
What the DMDC Data Breach Exposed and How Big It Was
The DMDC data breach exposed unencrypted files that held Social Security numbers (SSNs) plus at least one other identifier for each person. That second identifier could be a name, date of birth, contact information, sex, race, or military personnel data such as an occupational specialty.
In September 2026, DMDC said it had found a vulnerability in a file-sharing system on July 16, 2026. The flaw let unauthorized users open unencrypted files with full names, SSNs, birth dates and military occupations. A later review found unauthorized access to files on a server going back to October 2025.
| Date | Event |
|---|---|
| October 2025 | Earliest unauthorized access to server files, found by a later review |
| July 16, 2026 | DMDC discovers the file-sharing vulnerability |
| September 18, 2026 | Date on the notification letter |
| September 24, 2026 | Military Times first reports the breach |
| October 20, 2026 | Two Marines file a proposed class action |
The complaint alleges the exposure lasted approximately nine months before discovery. From the July 16 discovery to the September 18 letter is about two months.
A defense official put the total at about 2.76 million living people and 294,000 deceased people, according to reporting published by Defense News. Added together, 2.76 million plus 294,000 is roughly 3.05 million records. Earlier reports, citing people familiar with the incident, estimated about 4 million.
The people affected include service members, veterans and others affiliated with the military. The notification letter says the department has no indication the information has been misused.
The two Marines who sued allege fraudulent charges on their accounts. No court has decided whether the breach caused those charges.
Ways to Lock Down Credit After the DMDC Breach
Four protections handle different risks from an exposed SSN: a credit freeze, an initial fraud alert, an active duty alert and an Internal Revenue Service (IRS) Identity Protection Personal Identification Number (IP PIN).
| Protection | What It Does | Terms |
|---|---|---|
| Credit freeze | Blocks new creditors from opening accounts in your name until you lift it | Free under federal law at Equifax, Experian and TransUnion; placed at each bureau separately |
| Initial fraud alert | Asks creditors to verify your identity | Lasts one year |
| Active duty alert | An alert placed by active-duty service members | Lasts one year |
| IRS IP PIN | Stops someone else from filing a tax return with your SSN | Offered to taxpayers who can verify their identity |
If you got the September 18 letter, start with a credit freeze at all three bureaus. It blocks new creditors from opening accounts in your name until you lift it. If you are on active duty, add the active duty alert. Confirm the current terms for each protection with each bureau and at identitytheft.gov.
The IP PIN guards your tax filing, which is a separate target from your credit file. The IRS offers it through its Identity Protection PIN page to taxpayers who can verify their identity.
The IDX monitoring and a credit freeze are separate tools, and you can use both. The IDX offer provides credit monitoring and identity restoration for 12 months, while the freeze blocks new creditors until you lift it.
Active-duty readers can also read our guide to military credit card rights under the Servicemembers Civil Relief Act and Military Lending Act, which covers credit card protections for service members.
Watching DFAS myPay, Bank and VA.gov Accounts for Fraud
The accounts to watch after the DMDC breach are the ones that move your money: any DFAS myPay account, your bank accounts and any VA.gov account you have. Log in on a regular schedule and look for these warning signs.
- A direct deposit account on your pay that you did not set up.
- An allotment you did not start, or one of yours that now goes to an account you do not recognize.
- A mailing address, phone number or email on file that you did not change.
- Charges or withdrawals at your bank that you do not recognize. The two Marines suing over the breach allege fraudulent charges on their accounts.
- A change to where your VA payments are sent that you did not make.
- A jump in spam calls, texts or emails, which the lawsuit also alleges.
If you find a change you did not make, contact DFAS, your bank or VA through a phone number you already trust, such as the one printed on your bank card. Do not call a number from an email or text that reached you after the breach.
Write down each problem, the date you found it and any money you lost. The Privacy Act requires proof of actual damages before a person can recover money, so a dated record of real losses could matter if the lawsuit moves forward.
The Marines' DMDC Data Breach Lawsuit
Two Marines filed a proposed class action over the DMDC data breach on October 20, 2026, and the case is at the complaint stage. The case is Edwards v. United States Department of War, No. 1:26-cv-03667, in the U.S. District Court for the District of Columbia. The plaintiffs are Tristyn Edwards, a Marine veteran, and Morgan Stampfli, an active-duty Marine.
The suit names the Defense Department as the Department of War, a secondary name the department has used since 2025. OpenClassActions summarizes the complaint, which alleges these points:
- The vulnerability exposed millions of files for approximately nine months before anyone discovered it.
- DMDC failed to promptly notify affected people, and some were told two or three months after the breach was found.
- The complaint cites Defense Department Inspector General findings that officials had not shown effective operation on 14 of the 20 core metrics of the Federal Information Security Modernization Act review.
- The breach caused fraudulent charges on the plaintiffs' financial accounts and an increase in spam messages.
These are allegations. The Defense Department has not responded in court, and no one has established that the breach caused the plaintiffs' charges.
Privacy Act Damages and the $1,000 Minimum
The suit is brought under the Privacy Act of 1974, which lets a person sue the government over an intentional or willful violation that causes actual damages. A person who proves an intentional or willful violation that caused actual damages can recover at least $1,000, plus attorneys' fees. Without proof of actual damages, a person cannot recover money under the Act, so the $1,000 figure is a floor for proven losses.
Case Status and Payouts
No class has been certified in the DMDC breach lawsuit. There is no settlement, no claim form and no deadline, so you have nothing to file or join today. The IDX monitoring offer is separate from the lawsuit.
Until a court certifies a class or the parties reach a settlement, keep your records and take the account steps earlier on this page.
Scam Calls and Messages About the DMDC Breach
Do not give your SSN to anyone who contacts you offering to find out whether you were in the DMDC breach or to file a claim for you. No claim form exists for the lawsuit, so an offer to file a claim is an offer to do something that cannot be done today.
Treat these contacts as warning signs:
- A caller who offers to look up your breach status and asks for your SSN to do it.
- A text or email offering to file a lawsuit or settlement claim on your behalf.
- Credit monitoring sign-up steps that differ from the instructions printed in your letter.
If one of these reaches you, end the call or delete the message, and use only the enrollment instructions in your September 18, 2026 letter.
This page is general information and is not legal or financial advice. Rank and Pay is not affiliated with the Department of Defense, DMDC, IDX or any court. For your own situation, verify with the VA or your finance office.