Two Marines Sue Pentagon Over Data Breach That Exposed About 3 Million People's Records

Two Marines have sued the Department of War over a cyber breach that their lawyers say exposed the personal information of about 3.05 million people, including Social Security numbers, according to a class action complaint filed Oct. 20 in the U.S. District Court for the District of Columbia.

The case, Edwards v. United States Department of War, No. 1:26-cv-03667, was filed by Tristyn Edwards of California, who enlisted in the Marine Corps around September 2023 and still works for the military, according to the complaint, and Morgan Stampfli of New York, who served in the Marines from 2010 to 2021. They are suing on behalf of everyone whose data was exposed. The lawsuit is brought under the Privacy Act of 1974.

What the Complaint Says About the Data Breach

The breach hit the Defense Manpower Data Center, which keeps personnel, pay, training and other records for the department. Citing the department's own figures, the complaint says the center held more than 60 million records as of fiscal 2024 on service members, civilian staff, contractors, family members, retirees and veterans.

According to the complaint, the department found a vulnerability in one of the center's file-sharing systems around July 16, 2026. The filing says unauthorized users had been inside since October 2025, about nine months without being noticed. It says the exposed data included Social Security numbers, full names, dates of birth, contact information and military details such as occupational specialty. The complaint cites reporting by Federal News Network and Nextgov/FCW for those details.

Both Marines say they got form letters around Sept. 18, 2026, saying their information had been compromised. According to the complaint, Edwards had already seen $317.91 in fraudulent debit card charges on about Aug. 20, before he was notified. Stampfli says that days after his notice, someone used his debit card for a $271.19 online purchase with his correct name, address and phone number. The complaint also says Edwards received emails telling him his personal information was available on the dark web.

The lawsuit argues that the department failed to protect the data and waited too long to warn the people affected. It says the department has not given any assurance that the stolen data has been recovered or destroyed.

What the Marines Are Seeking

The Marines are asking for class certification, actual and statutory damages under the Privacy Act, attorneys' fees and a jury trial. They are represented by Migliaccio & Rathod LLP of Washington.

These are allegations, and the department has not yet answered the complaint in court. Reuters, Federal News Network and Defense News have also reported on the lawsuit.

Image: Aerial view of the Pentagon (file photo), U.S. Navy photo, public domain.

Yossi Schmidt, Founder and Editor-in-Chief, The Digital Free Press

Hold Everyone Accountable.

Sources: Complaint, Edwards v. U.S. Department of War, No. 1:26-cv-03667 (D.D.C., filed Oct. 20, 2026): https://storage.courtlistener.com/recap/gov.uscourts.dcd.297816/gov.uscourts.dcd.297816.1.0.pdf ; Court docket (CourtListener): https://www.courtlistener.com/docket/74992272/edwards-v-united-states-department-of-war/ ; Federal News Network, Sept. 28, 2026 (cited in the complaint): https://federalnewsnetwork.com/defense-main/2026/09/more-than-3-million-people-affected-by-military-data-breach ; Federal News Network, "Pentagon sued over data breach affecting more than 3 million people" (Oct. 2026): https://federalnewsnetwork.com/defense-news/2026/10/pentagon-sued-over-data-breach-affecting-more-than-3-million-people/ ; Defense News, "Pentagon ignored cybersecurity flaws before data breach, Marines' lawsuit says" (Oct. 22, 2026): https://www.defensenews.com/news/pentagon-congress/2026/10/22/pentagon-ignored-cybersecurity-flaws-before-data-breach-marines-lawsuit-says/