Two Marines have filed a class-action lawsuit against the Defense Department over a breach at the Defense Manpower Data Center that left Social Security numbers and other personal records open to unauthorized users for about nine months. The 39-page complaint, filed Tuesday, Oct. 20, in U.S. District Court in Washington, seeks class status for roughly 3 million military-connected people, a jury trial and $5 million in damages, Stars and Stripes reported on Oct. 22.
The plaintiffs are Tristyn Edwards, an active-duty Marine from California who enlisted in 2023, and Morgan Stampfli, a New York resident who served from 2010 to 2021, according to Stars and Stripes. Federal News Network also identified Edwards as the active-duty Marine and Stampfli as the veteran. Stars and Stripes reported that the case is before U.S. District Judge Tanya Chutkan.
Defense officials declined to comment to Stars and Stripes, citing pending litigation. When the department disclosed the breach in September, a Pentagon official said there was “no indication that anyone’s personal information has been misused,” Federal News Network reported.
What the Marines’ lawsuit claims
The core legal claim is that the department violated the Privacy Act of 1974 by failing to protect personnel records and to put adequate cybersecurity controls in place despite internal warnings, Federal News Network reported. The complaint leans on Defense Department inspector general reports going back to 2021 and accuses the department of having “intentionally and willfully” disregarded its cybersecurity responsibilities.
One of those reports, published days after the breach was found, said officials had not shown effective operation on 14 of 20 core metrics under the Federal Information Security Modernization Act, according to Military Times. The suit argues that routine measures would have stopped the breach: regular account reviews, vulnerability scanning, field-level encryption or tokenization of Social Security numbers, and log monitoring.
Both men say the damage is already showing up in their accounts. According to Stars and Stripes, Edwards found $317 in fraudulent debit card charges, one of them to PeopleFinder. Stampfli reported $271 in charges at a restaurant supply store, with the goods shipped to an Illinois address. Federal News Network reported that Edwards also says credit lines were opened in his name, and that he worries identity theft could put his job at risk because it requires a security clearance. Both report a “drastic” increase in spam calls and emails, Federal News Network reported.
The complaint also says the department did not reach affected people until late September or early October, two to three months after it found the flaw. It warns that misuse could continue “for months or years” and says the department has not said whether copies of the data were recovered or destroyed.
What DMDC is and why its records matter
The Defense Manpower Data Center is one of the Pentagon’s main personnel record repositories. It holds more than 60 million records on active-duty and reserve troops, civilian employees, contractors, retirees, veterans and military family members, ABC News reported.
Most troops and families deal with DMDC systems without knowing the name. DMDC runs the Defense Enrollment Eligibility Reporting System, or DEERS, which TRICARE says shows whether you and your family are eligible for and enrolled in TRICARE. Service members check and update those records through milConnect. DEERS also verifies identity and DoD affiliation for issuing military ID cards, including the Common Access Card, according to the Coast Guard.
Timeline of the DMDC breach
- October 2025: Unauthorized users begin getting into files on a DMDC server through a vulnerability in a file-sharing system, according to the notification letter reviewed by Military Times.
- July 16, 2026: DMDC finds the flaw, patches the system and puts it back in service. The files held unencrypted personal data.
- Sept. 18: Date on the DMDC notification letter. Two defense officials confirmed to Military Times that the letter was authentic.
- Sept. 28: A U.S. defense official tells ABC News the breach affected about 2.76 million living people and 294,000 deceased people.
- Oct. 20: Edwards and Stampfli file their class action in Washington.
Exposed data included Social Security numbers plus at least one other identifier, such as name, birth date, contact information, sex, race or military details like occupational specialty, Military Times reported. In a statement to ABC News, the defense official said a DMDC system “experienced unauthorized access of personally identifiable information” by “a small number of unauthorized users between October 2025 and July 2026.” Who got in, and what they viewed, remains unknown publicly. MOAA noted on Sept. 30 that neither the Pentagon nor DMDC had issued a public news release.
The department is offering affected people 12 months of credit monitoring and identity-restoration services through IDX, a private company it hired.
Steps to protect yourself after the DMDC breach
None of this depends on the lawsuit, and most of it is free.
- Look for the letter. Notices dated Sept. 18 went to people whose data was in the affected files. If you got one, keep it. It has your IDX enrollment details.
- Enroll in the free IDX coverage. The IDX response page for DMDC offers 12 months of credit monitoring and access to an advocate who can open an identity theft case. The page says enrollment asks for your name, address, phone and email, not your Social Security number. Monitoring is for adults. If you already have a credit freeze, IDX says you’ll need to lift it briefly so monitoring can be activated.
- Freeze your credit at all three bureaus. A freeze is free, doesn’t affect your credit score and stays in place until you lift it, according to the FTC. You have to contact Equifax, Experian and TransUnion separately. See the table below.
- Place an active duty alert if you’re serving. The alert requires businesses to take extra steps to confirm it’s you before they open credit in your name. It lasts one year and can be renewed to cover a deployment. Call one bureau and it must notify the other two. The bureaus will also drop you from prescreened credit offer lists for two years, according to the FTC’s Military Consumer site. Veterans and spouses can’t use this alert, but anyone can place a one-year fraud alert.
- Use the free military credit monitoring. Under an FTC rule, the nationwide credit bureaus must give active-duty service members free electronic credit monitoring. It runs separately from the IDX offer, so you can have both.
- Read your credit reports. Look for accounts or hard inquiries you don’t recognize. The annual credit report line is 1-877-322-8228.
- If someone uses your identity, report it. File at IdentityTheft.gov, the FTC’s site, which turns your report into a personal recovery plan. An FTC identity theft report also lets you get an extended fraud alert, which lasts seven years.
- Watch for phishing. Don’t give personal details to callers or emailers claiming to be from DMDC, TRICARE or a credit bureau. Call back on a number you look up yourself.
- If you hold a clearance, tell your security manager. Fraud reported early, with paperwork, is easier to explain than fraud that surfaces later.
Credit freeze contacts
| Bureau | Official freeze page | Phone |
|---|---|---|
| Equifax | equifax.com security freeze | 888-298-0045 |
| Experian | experian.com freeze center | 888-397-3742 |
| TransUnion | transunion.com credit freeze | 800-916-8800 |
Another privacy ruling for federal workers this week
The lawsuit lands the same week a federal judge ruled against the government in a separate Privacy Act case. On Oct. 20, U.S. District Judge Denise Cote of the Southern District of New York found that the Office of Personnel Management unlawfully gave the Department of Government Efficiency access to sensitive federal personnel data in early 2025, Federal News Network reported. “At this point, there is no meaningful dispute concerning the underlying conduct,” Cote wrote. Relief, including the plaintiffs’ request that DOGE-held copies of OPM data be deleted, will be decided separately.
DMDC breach lawsuit FAQ
How do I know if my data was exposed?
The department sent notification letters, dated Sept. 18, to people whose information was in the affected files. If you didn’t get one but are worried, the steps above, especially a credit freeze, cost nothing and protect you either way.
Do I have to join the lawsuit to be covered?
No. The case is a proposed class action and a judge hasn’t certified a class. If one is certified, members are usually notified. You don’t need to sign up for anything now to keep your rights.
Is the IDX credit monitoring a scam?
No. Military Times and MOAA reported that IDX is the company the Defense Department hired to provide the 12 months of monitoring and identity restoration. Type the address from your letter yourself rather than clicking links in unexpected emails.
Does a credit freeze stop me from using my cards or applying for a home loan?
Existing cards keep working. A freeze blocks new creditors from pulling your report. When you apply for a mortgage, car loan or new card, lift the freeze at the bureau the lender uses, then put it back afterward.
Official links
- Defense Manpower Data Center (DMDC)
- IDX response page for DMDC notification recipients
- IdentityTheft.gov (FTC)
- FTC: Credit freezes and fraud alerts
- Military Consumer (FTC): Active duty alerts
- FTC Military Credit Monitoring Rule
- TRICARE: Check your information in DEERS
- Equifax security freeze
- Experian freeze center
- TransUnion credit freeze
Photo: mariordo59/Wikimedia Commons, CC BY-SA 2.0.
