The Defense Department breach that exposed Social Security numbers for about 2.76 million living people also swept in records for roughly 294,000 people who have died, Time reported.
Unauthorized users got into a file-sharing system at the Defense Manpower Data Center between October 2025 and July 16, 2026, when the vulnerability was found and patched.
The files were unencrypted and held Social Security numbers along with at least one other identifier, such as names, birth dates, contact information or military job details, according to Stars and Stripes. The records cover troops, civilian employees, contractors, retirees, veterans and military family members.
Notification letters sent Sept. 18 offer one year of free credit monitoring and identity restoration through identity protection provider IDX and say there has been no indication the data was misused. Published reports have not described how, or whether, the department is reaching families of the people who have died.
Credit monitoring is built for the living. A parent or spouse who has died cannot enroll, cannot spot a strange account and cannot answer a collection call, which is why the job falls to the family.
Why a dead person’s number is worth stealing
Credit bureaus usually learn of a death from the Social Security Administration or from the person’s creditors. “It can take some time for that notification to happen, and some identity thieves try to capitalize on that delay to use your loved one’s information for nefarious purposes,” Experian says.
During that gap, a stolen number paired with a name and birth date may be enough to apply for credit or file a tax return. With no one checking the mail or the credit report, fraud can go unnoticed until an executor starts settling the estate or a collection letter arrives.
Put a deceased alert on the credit file
Send TransUnion, Experian or Equifax a copy of the death certificate and ask them to flag the file. Once the flag is in place, a lender that pulls the report sees a deceased alert and can stop an application. And whichever credit bureau you contact, it will notify the other two.
TransUnion accepts requests by mail at P.O. Box 2000, Chester, PA 19016, and requires the death certificate plus the person’s legal name, Social Security number, date of birth, and date of death. The company says it notes the death within five business days.
Experian also accepts a certified copy by mail at P.O. Box 4500, Allen, TX 75013, or through an online upload.
A spouse or executor can also request the deceased person’s credit report from each bureau, Equifax says, by sending a copy of the death certificate or a letter of testamentary. Look for accounts or inquiries dated after the death.
Watch the tax account
The IRS advises survivors to file the deceased person’s final tax return when due, send the credit bureaus a death certificate and keep obituaries light on details a thief could use, according to its identity theft guide. If a return is rejected because someone already filed using that Social Security number, the personal representative can file Form 14039, the IRS Identity Theft Affidavit.
If you find fraud, the Identity Theft Resource Center says IdentityTheft.gov has a section for reporting on another person’s behalf. You will generally need to show you are the executor or otherwise have legal authority to act. The nonprofit also offers free phone help at 888-400-5530.
The living need a plan, too
A widow or widower who shared a household with a service member, military retiree or Defense Department civilian may have records in the same system. If you received a letter, follow its instructions to enroll in the free monitoring, then go further.
A credit freeze at Equifax, Experian and TransUnion is free and can stop most new credit accounts from being opened in your name. These free fixes after a data breach, including an IRS identity protection PIN, apply here as well.
It also helps to know what a thief can do with a Social Security number, since this breach exposed it unencrypted.
If you would rather hand off some of the watching, you can compare identity protection services to see what each one monitors and what it costs after any free period ends.
A letter nobody will open
For roughly 294,000 people in these files, a breach notice and a year of free monitoring mean nothing. A few letters from whoever handles their affairs, each with a death certificate enclosed, can close the door the breach left open.
Add a Comment