Two Marines Sue the Pentagon Over the DMDC Data Breach: How Privacy Act Damages Work
Two Marines have filed a Privacy Act lawsuit against the Pentagon over the Defense Manpower Data Center (DMDC) data breach, which exposed the personal information of more than three million people, including Social Security numbers. The Pentagon says it has no indication that anyone's data was misused. The Marines tell a different story, and their complaint shows exactly what it takes to win damages under the Privacy Act.
What Happened in the DMDC Breach
According to Federal News Network, a vulnerability in DMDC's file-sharing system gave a small number of unauthorized users access to records for nearly nine months. DMDC discovered the problem in July, and affected individuals were not notified until late September. The exposed data included names, dates of birth, Social Security numbers, and contact information.
An active-duty Marine and a Marine veteran filed a proposed class action in federal court in Washington, D.C., on October 20, 2026. The plaintiffs describe fraudulent charges since the breach, including a debit card charge one of them never made.
Why the Inspector General's Warnings Matter
The complaint relies heavily on the Pentagon's own inspector general, which warned in writing about the department's cybersecurity as far back as 2021. That is not just background. Under the Privacy Act, a person can recover money damages only if the agency acted intentionally or willfully. 5 U.S.C. § 552a(g)(4). Courts in the D.C. Circuit have described that standard as conduct that flagrantly disregards a person's rights. Years of documented warnings are how plaintiffs try to meet that test.
How Privacy Act Damages Work
If a plaintiff clears the intentional-or-willful bar, the statute sets a minimum recovery of $1,000 for a person who proves actual damages. With a proposed class of more than three million people, the potential exposure is significant.
There is an important catch. The Supreme Court has held that "actual damages" under the Privacy Act means proven economic loss, not emotional distress. FAA v. Cooper, 566 U.S. 284 (2012). That is why the complaint leads with fraudulent charges rather than anxiety. Nothing in the case has been decided yet.
What to Do If You Received a DMDC Breach Notice
- Freeze your credit with all three credit bureaus. It is free.
- Enroll in the credit monitoring the Pentagon is offering.
- Keep every record. Save the notice, every fraudulent charge, and every dollar and hour you spend cleaning it up. Under this law, documented financial loss is what makes damages possible.
- If you hold a security clearance, report identity theft that affects your finances to your security officer rather than waiting.
Why This Matters for Every Federal Employee
The same Privacy Act that governs this case also covers every federal employee's personnel records. How courts apply its intentional-or-willful standard and its actual-damages rule shapes the protection you have when an agency mishandles your information.
If you have questions about how a data breach or a Privacy Act violation affects you, contact Southworth PC.
Legal Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Federal employment situations are fact-specific and time-sensitive. Please consult a qualified federal employment attorney about your specific situation. You can contact Southworth PC at attorneysforfederalemployees.com.