Marines Sue Pentagon Over Data Breach
PHOTO CAPTION: A U.S. Marine Corps information technology server facility at Camp Lejeune, North Carolina, photographed in January 2013. A proposed class-action lawsuit filed October 20, 2026, accuses the Pentagon of failing to protect personal information belonging to approximately 3 million military-connected individuals. The facility pictured was not involved in the breach. (U.S. Marine Corps photo by Lance Cpl. Jackeline M. Perez Rivera)
A current U.S. Marine and a former Marine have filed a proposed class-action lawsuit against the Pentagon after a major security breach exposed sensitive personal information belonging to approximately 3 million military-connected individuals.
The lawsuit, filed October 20 in U.S. District Court for the District of Columbia, accuses the Defense Department of failing to adequately protect records containing Social Security numbers, birth dates and other personal information.
The breach affected the Defense Manpower Data Center, a federal organization responsible for maintaining personnel records used by military members, civilian employees, contractors, retirees and their families.
According to the complaint, unauthorized users accessed sensitive files for approximately nine months before the vulnerability was discovered.
Personal Data Exposed for Months
The breach began in October 2025 and continued until July 16, 2026, when Defense Manpower Data Center officials identified a vulnerability in a file-sharing system.
The compromised files contained unencrypted personal information, including Social Security numbers and other identifying details.
Depending on the individual, those records included names, dates of birth, contact information, sex, race and military occupational specialties.
Federal officials previously confirmed that approximately 2.76 million living individuals and 294,000 deceased individuals were affected.
The department said it patched the vulnerability after discovering it.
However, the lawsuit alleges the government failed to detect the unauthorized access for months and did not notify affected individuals until September.
Marine Reports Fraudulent Bank Charges
The two plaintiffs are Tristyn Edwards, who enlisted in the Marine Corps in 2023, and Morgan Stampfli, who served from 2010 to 2021.
Edwards alleges he experienced multiple fraudulent debit-card transactions on August 20, totaling $317.91.
He said those transactions occurred before the Pentagon notified him on September 18 that his personal information had been compromised.
According to the complaint, Edwards also received notifications that his information was available on the dark web and experienced increased spam calls and emails.
Stampfli alleges that an unauthorized $271.19 purchase appeared on his Navy Federal Credit Union debit card after he received his breach notification.
The transaction reportedly used his correct name, billing address, telephone number and other identifying details.
He canceled the compromised debit card and later experienced an influx of unwanted email subscriptions.
Both plaintiffs argue that the government's failure to adequately protect their information exposed them to financial risks.
The lawsuit has not established that the breach directly caused the disputed financial transactions.
Pentagon Offered One Year of Credit Monitoring
The Defense Department began notifying affected individuals in September.
The notification letters acknowledged that unauthorized users had accessed files containing unencrypted personal information.
Officials said the vulnerability had been patched and offered eligible individuals 12 months of complimentary credit monitoring and identity-restoration assistance.
At the time of the notifications, the department said it had no indications that the accessed information had been misused.
The Marines' lawsuit argues that one year of monitoring is insufficient because compromised personal information could potentially be exploited years after a security incident.
The plaintiffs also question why the department did not discover the activity sooner or notify affected individuals more quickly.
Lawsuit Seeks Damages for Affected Military Personnel
The complaint alleges that the department violated the Privacy Act of 1974, which requires federal agencies to maintain appropriate safeguards for personal records.
The plaintiffs are seeking to represent a nationwide class of affected individuals.
The filing states that more than $5 million is in controversy and requests damages, attorneys' fees and other appropriate relief.
The case remains in its early stages. A judge has not certified the proposed class or determined that the department violated the law.
The Pentagon did not immediately respond to Reuters' request for comment on the October 21 lawsuit report.
Military Personnel Records Under Scrutiny
The Defense Manpower Data Center maintains information used for military personnel administration, benefits, identification and other government functions.
Unlike information voluntarily shared with many private companies, much of this data is required from individuals as part of military service or their relationship with the Defense Department.
That has made the breach a significant concern for current and former service members whose records were involved.
The October 20 lawsuit adds a new legal challenge to a security incident first publicly disclosed in September.
Whether the plaintiffs can establish that the department violated federal privacy requirements, and whether affected individuals are entitled to compensation, will be determined through the federal court process.
(Source: OAF Nation)
