Two U.S. Marines have filed a class-action lawsuit against the Department of Defense after a file-sharing vulnerability in a Pentagon personnel database exposed the sensitive records of roughly 3 million military personnel, veterans and family members. The suit accuses the department of violating federal privacy law despite prior internal warnings about weak cybersecurity controls.
What went wrong inside the Defense Manpower Data Center
The Defense Manpower Data Center (DMDC), a Pentagon repository holding more than 60 million records on service members, civilian employees, contractors, veterans and military families, disclosed on July 16 that it had found a security flaw in its file-sharing system. The flaw allowed unauthorized users to reach confidential files without proper credentials. DMDC said it launched an internal investigation, applied security patches and restored the affected system, but the exposure had already allowed outside access to protected data.
What information was exposed
According to the lawsuit and related reporting, the compromised data included full names, dates of birth, Social Security numbers, contact information, sex, race and military personnel records. DMDC has not released an official count of affected individuals, but Pentagon officials reportedly confirmed to media outlets that the breach touched the personal information of approximately 3 million people, a scale that places it among the larger federal data incidents involving military personnel.
The legal claims and what plaintiffs are seeking
Active-duty Marine Tristyn Edwards and veteran Morgan Stampfli filed the suit in federal court in the District of Columbia, arguing the Pentagon violated the Privacy Act of 1974 by failing to implement adequate safeguards for sensitive personal data. The complaint alleges the department had received earlier internal warnings about potential vulnerabilities but did not act in time to prevent the breach. The plaintiffs are seeking to represent the full class of more than 3 million affected individuals and are requesting over $5 million in damages.
Why this matters beyond the lawsuit
The Privacy Act of 1974 requires federal agencies to maintain reasonable safeguards over records containing personal data and gives individuals legal recourse when agencies fail to do so. Because DMDC records intersect with benefits, pay and security clearance systems, exposed Social Security numbers and personnel histories can heighten risks of identity theft and targeted fraud against service members. The case is still in early stages, and courts have not yet ruled on class certification or the merits of the claims.