A new class action claims a Department of War data breach went undetected for nine months.

On Oct. 20, 2026, active-duty Marine Tristyn Edwards and former Marine Morgan Stampfli filed a class action lawsuit against the U.S. Department of War in the U.S. District Court for the District of Columbia.

The lawsuit claims the Pentagon failed to put basic safeguards around the personal information of more than 3 million people, which unauthorized users accessed for nearly nine months.

The data breach

Starting in October 2025, unauthorized users allegedly exploited a security flaw to open files on a file-sharing system at the Defense Manpower Data Center. That department office keeps personnel, benefits and ID records for service members, veterans, civilian staff, contractors and their families, the proposed class action claims.

The exposed files included:


  • Names

  • Social Security numbers

  • Birth dates

  • Contact information

  • Sexes

  • Races

  • Military occupations

The Department of War reportedly discovered the breach July 16, 2026. In notice letters it began mailing in mid-September 2026, the department says the files resided on a server containing unencrypted personal information. The complaint quotes the letter at length. On Sept. 28, 2026, a Pentagon official told Federal News Network the breach affected about 2,800,00 million living and 294,000 deceased people.

The plaintiffs' reported experiences

Edwards claims he discovered $317.91 in fraudulent charges on his debit card nearly a month before his notice letter arrived on Sept. 18, 2026. He says one charge was for a website that looks up personal information, which he believes came from someone using his stolen data.

Edwards also allegedly received emails stating his information is available on the dark web. His security clearance prevents him from using common protections, such as a credit freeze, the filing contends.

Stampfli says he received his data breach notification letter the same day. Days later, he claims someone used his name, address, phone number and debit card details to place a $271.19 online order that shipped to a stranger in Illinois. He also received sign-up confirmations for unrelated newsletters he never joined in his email inbox, the lawsuit alleges.

Both men claim the department's offer of 12 months of free credit monitoring is not an adequate remedy as some identity theft harms may not surface for years.

The department's alleged security failings

Department of War policy requires system owners to check logs for suspicious activity at least weekly. The plaintiffs contend that nine months of unnoticed access shows it did not follow that rule or encrypt Social Security numbers.

Their complaint also cites a July 2026 inspector general report that found the department's overall information security program was ineffective for five years.

The legal claim

Under the Privacy Act of 1974, federal agencies must set up appropriate safeguards to keep the records they hold secure and confidential. Edwards and Stampfli allege the Pentagon willfully and intentionally failed to meet that duty.

The class action seeks damages for class members plus attorneys' fees, litigation costs and interest.

What the lawsuit means for people who received a breach letter

The proposed class covers everyone whose personal information unauthorized users accessed in the breach the department discovered on July 16, 2026. As of this writing, there is no settlement, no claims process and no money available.