DMDC Data Breach Lawsuit: Will Victims Get Paid?

Two Marines are suing over the breach that exposed about 3 million military records. The last major federal breach case, brought under the same law in the same court, paid only people who could document a loss.

Published November 6, 2026 · Last updated November 6, 2026

Key takeaways

Two Marines filed a proposed class action, Edwards v. United States Department of War, No. 1:26-cv-03667, in federal court in Washington, D.C., on October 20, 2026, over the Defense Manpower Data Center (DMDC) breach.
There is no settlement, claim form or deadline. No class has been certified, and you do not need to sign up for anything to be counted in a proposed class.
The case is brought under the Privacy Act of 1974, which pays money only to people who can show actual financial harm.
In the OPM breach case, a $63 million settlement paid about 5,000 people out of more than 22 million affected. About $58.2 million went back to the U.S. Treasury.
The records you keep now, such as receipts, statements and a log of the time you spend, are the kind of proof that settlement required.

If you received a letter dated September 18, 2026 from the Defense Manpower Data Center, you have probably seen the headlines: two Marines are suing the Pentagon over the breach that exposed Social Security numbers in about 3 million records. The obvious next question is whether anyone affected will see money from it.

Nobody can answer that yet. There is, however, a close precedent: the lawsuit over the 2015 Office of Personnel Management (OPM) breach. That case was a federal breach case, brought under the same law and in the same courthouse. It ended in a settlement that most eligible people never collected from, mainly because they could not show the paperwork the law requires. This article explains why.

What the DMDC lawsuit claims

The plaintiffs are Tristyn Edwards and Morgan Stampfli, a current and a former Marine, represented by the firm Migliaccio & Rathod. They filed in the U.S. District Court for the District of Columbia on October 20, 2026 (docket). They want to represent roughly 3 million military-connected people and are seeking more than $5 million in damages, according to Stars and Stripes.

The complaint alleges that the Defense Department:

kept Social Security numbers and other personal data unencrypted on a file-sharing system;
ignored cybersecurity weaknesses flagged by its own inspector general in reports dating back to 2021, as reported by Military Times;
did not detect unauthorized access for roughly nine months; and
waited until late September or early October to warn the people affected, two to three months after it found the problem.

According to the complaint, Edwards found $317.91 in fraudulent debit card charges before his notice letter arrived. These are allegations. No court has found that the breach caused those charges, and the department has not yet responded in court. Defense officials declined to comment to Stars and Stripes, citing the pending litigation.

The breach itself

According to the notification letter, DMDC found a vulnerability in a file-sharing system on July 16, 2026, patched it, and later determined that “a small number of unauthorized users” had access to files on the server from October 2025 onward. A Pentagon official told TIME that 2.76 million living people and 294,000 deceased people were affected.

The exposed files held Social Security numbers plus at least one other identifier, such as a name, date of birth, contact information, sex, race, or military personnel data like occupational specialty. The letter says the department has no indication the information has been misused. For background on the breach, see our data breach coverage.

Why suing a federal agency is different

Most breach lawsuits target private companies and rely on state negligence and consumer protection laws. Many of those cases settle for a flat payment that anyone in the class can claim without proof of loss. That model rarely applies when the defendant is the federal government.

The government can be sued for money only where Congress allows it. For personnel records, the main path is the Privacy Act of 1974 (5 U.S.C. § 552a). Under subsection (g)(4), if an agency acted “intentionally or willfully,” the United States is liable for a person’s actual damages, with a floor of $1,000, plus court costs and attorney fees. Two Supreme Court decisions narrow what that means:

Doe v. Chao (2004): the $1,000 minimum is available only to someone who first proves actual damages. It is not automatic.
FAA v. Cooper (2012): “actual damages” means proven financial loss. Emotional distress alone does not qualify.

The law also sets a two-year deadline to sue, generally counted from when the claim arises. In practical terms, worry and inconvenience alone are unlikely to support a money recovery under the Privacy Act. Documented costs might.

How the OPM breach case played out

In 2015, OPM disclosed breaches that compromised personal data on more than 22.1 million current and former federal employees, contractors and security clearance applicants. The lawsuits were consolidated in the same federal court now hearing the DMDC case. A district judge dismissed them in 2017. In 2019, the D.C. Circuit revived the case, holding that the plaintiffs had standing to sue.

In 2022, OPM and its contractor Peraton agreed to a $63 million settlement, and U.S. District Judge Amy Berman Jackson gave it final approval that October. Eligible claimants would receive at least $700 and up to $10,000. To qualify, they had to show an out-of-pocket expense or lost time from buying credit monitoring or identity protection, accessing or freezing a credit report, or dealing with identity theft, according to Nextgov.

Here is how it ended, as reported by Government Executive in January 2025:

OPM settlement	Result
People affected	More than 22.1 million
Claims filed	More than 27,000
Claims found payable	Fewer than 20%
People paid	Just over 5,000
Total paid out	$4.8 million of $63 million
Returned to the U.S. Treasury	$58.2 million
Time from breach disclosure to final approval	About seven years

Daniel Girard, the plaintiffs’ lead lawyer, told Government Executive that the Privacy Act claim “allows for recovery only on proof of compensable loss.” Even people who clearly qualified as victims received nothing if they could not show a cost.

What this could mean for DMDC breach victims

	OPM (2015)	DMDC (2025–2026)
People affected	About 22.1 million	About 3.05 million records
Main legal claim	Privacy Act of 1974	Privacy Act of 1974
Court	U.S. District Court, D.C.	U.S. District Court, D.C.
Free monitoring offered	Yes, later extended by Congress	12 months through IDX
Outcome	$63M settlement; about 5,000 paid	Complaint stage; no ruling

None of this predicts how the DMDC case will turn out. The government has not yet answered. The court may dismiss the case or allow it to proceed, and a class may or may not be certified. It may never settle. The cases also differ in their details: the OPM case included a private contractor as a defendant, and the courts’ reading of the Privacy Act continues to develop.

Two lessons from OPM do apply, though. First, Privacy Act recoveries have depended on documented financial loss. Second, these cases move slowly. The OPM settlement came seven years after the breach was disclosed, and records from the start of the case were hard to produce years later. Several class members objected for exactly that reason.

Records worth keeping now

Keeping these records costs nothing and preserves your options if you are affected. Store them in one folder, digital or paper, and keep it for several years.

The notice letter and its envelope. The letter is your evidence that your records were included, and the postmark shows when you were told.
Your IDX enrollment confirmation, if you enroll.
Bank and card statements showing any unauthorized charges, plus your bank’s dispute and resolution records.
Receipts for anything you pay for because of the breach, such as paid credit monitoring or identity protection beyond the free offer, mailing or notary costs, or replacement documents.
A dated log of your time. Note each call, credit freeze, dispute or account change: the date, who you contacted, and how long it took. Credit freezes are free, but the time you spend placing them can still be documented.
Fraud reports, if fraud happens: an IdentityTheft.gov report from the FTC and any police report.
Screenshots of suspicious messages that reference the breach, with sender details and dates.

Our digital evidence checklist explains how to save and organize these records so they stay usable later. If your identity has already been misused, start with our identity theft guides.

The credit monitoring offer is separate from the lawsuit

DMDC is offering 12 months of credit monitoring and identity restoration through IDX, a contractor. Enrolling has no effect on the lawsuit, and the lawsuit has no effect on your enrollment.

Use the code in your own letter. The defense official quoted by TIME directed questions to response.idx.us/DMDC and 1-855-744-4556.
Check the enrollment deadline printed on your letter. BleepingComputer and other outlets, citing the letters, report August 19, 2027.
Active-duty and reserve members can also get free credit monitoring from Equifax, Experian and TransUnion under federal law, and anyone can freeze their credit at all three bureaus for free.
Watch for imitations. Copies of the real letter have been posted online, which makes convincing fake versions easy to produce. Type the IDX address yourself instead of clicking links, and do not give your Social Security number to anyone who contacts you first about the breach. Our scams and fraud section covers how to verify unexpected messages.

Do you need to “join” the DMDC lawsuit?

No. In a proposed class action, people who fit the class definition are included automatically if a court certifies the class. There is currently no claim form to file. Online ads offering to help you “join the lawsuit” are usually law firm intake forms. Filling one out may connect you with a lawyer, but it does not make you a class member or file a claim.

If the case ever settles, the court must approve a formal notice and a claims administrator. Class members would then be told how to file a claim, opt out or object, and by when. If you have had significant losses, you can speak with a lawyer of your choosing about your own options, including the Privacy Act’s two-year filing deadline.

Timeline

Date	Event
October 2025	Unauthorized access to DMDC files begins, according to the notice letter
July 16, 2026	DMDC finds the file-sharing vulnerability and patches it
September 18, 2026	Date on the notification letters
September 24, 2026	Military Times first reports the breach
September 29, 2026	Pentagon official confirms 2.76 million living and 294,000 deceased people affected
October 20, 2026	Edwards v. United States Department of War filed in D.C. federal court
August 19, 2027	IDX enrollment deadline as reported from the letters (check yours)

Frequently asked questions

Is there a DMDC data breach settlement?

No. The lawsuit was filed on October 20, 2026 and is at the complaint stage. There is no settlement, claim form or claim deadline.

How much money could I get from the DMDC breach lawsuit?

There is no amount yet. The Privacy Act allows actual damages with a $1,000 minimum, but under Supreme Court precedent that minimum applies only to people who prove actual financial loss from an intentional or willful violation. In the OPM case, settlement payments ranged from $700 to $10,000 and went only to claimants who documented a loss.

Do I automatically get $1,000 if my data was exposed?

No. Under Doe v. Chao, the $1,000 floor applies only to people who first prove actual damages.

Will enrolling in IDX credit monitoring affect my rights in the lawsuit?

Nothing reported about the offer or the lawsuit suggests it would. The two are separate. Keep your enrollment confirmation with your other records.

How do I know if my DMDC breach letter is real?

Two defense officials confirmed to Military Times that the September 18 letter was authentic. Because copies of it have been posted online, check that a letter you receive arrived by mail, carries your own enrollment code, and points to response.idx.us/DMDC. Then type that address yourself.

What happened to the unclaimed OPM settlement money?

About $58.2 million of the $63 million fund went back to the U.S. Treasury after the claims period, because relatively few people submitted the proof the settlement required.

What we are watching

We will update this story when the government responds to the complaint and when the court rules on any motion to dismiss. Follow new filings in our lawsuits and settlements coverage and new notices in the breach notice tracker. You can also get updates in The Cyber Law Brief newsletter. If you were affected and want to share what happened, use our tip form.

Sources

This article is general information, not legal advice. Cyber Law Institute is an independent publication and is not a law firm. Reading this article does not create an attorney-client relationship. For advice about your situation, consult a licensed attorney. See our legal disclaimer and editorial standards.

The Cyber Law Brief

Get practical guides like this in your inbox

Weekly reporting. No noise. Unsubscribe anytime. Privacy Policy.

Pentagon DMDC Breach Lawsuit: What the OPM Settlement Shows About Who Gets Paid

Key takeaways