Military TRICARE Data Compromise: The Three 2026 Breaches, Who Got a Letter, and the Deadlines (October 2026)

October 31, 2026 at 11:59 p.m. UTC is the last moment a TRICARE West Region family named in TriWest Healthcare Alliance's July 2 letter can activate the 24 months of Experian IdentityWorks it offers. The letter is blunt: "Your code will not work after this date." That is the nearest deadline among three separate 2026 data compromises reaching TRICARE families, and the three are being searched for as one. Two are settled in documents anyone can read: TriWest's letter, filed as a sample with the California Attorney General, and the Defense Health Agency notice of May 13, 2026 on the Express Scripts military pharmacy site. The third and largest, at the Defense Manpower Data Center, has a letter dated September 18 and an IDX enrollment page, but as of October 12, 2026 no press release. Its headcount comes from Pentagon officials speaking to reporters.

Three compromises, one table

Each row comes from that incident's own notice; the two figures with no document behind them are marked by who said them. The offers are free and separate.

DMDC: the breach behind the Pentagon headlines

The DMDC letter reads: "On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered" that "allowed unauthorized users to access files." Then the sentence that matters: "Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII." DMDC "does not have any indications of misuse of the accessed information."

A TRICARE search lands here because DMDC keeps the roster every ID card and eligibility check runs against. Its home page calls it "the one, central access point for information and assistance on DoD entitlements, benefits, and medical readiness for uniformed service members, veterans, and their families," with milConnect and the DoD ID Card Reference Center as quick links. This is a breach of the file behind TRICARE, not of a TRICARE contractor.

The only official web page on the incident is the IDX enrollment site: "Defense Manpower Data Center is offering IDX identity theft protection services," with "Credit Monitoring for 12 Months." It carries no description of the breach, no date and no deadline; the August 19, 2027 cutoff appears only in the letter. On the count, Military Times' first report on September 24 said about four million, from two people familiar with the incident; five days later a Pentagon official gave TIME 2.76 million living and 294,000 deceased. Until the Department publishes, the number is what an official said on a given day.

TriWest: 11,844 letters and an October 31 deadline

The TriWest letter, dated July 2, 2026, says: "On April 16, 2026, we found unauthorized activity on our network. An unauthorized person accessed and downloaded some TriWest information." The fields it lists are "Name," "Department of Defense Benefits Number," "ZIP code" and "Type of authorization request (for example, physical therapy)." TriWest told Military Times it notified 11,844 people, and that in fewer than five cases the download also held a Social Security number, address and date of birth. The letter went out 77 days after discovery. The same contractor's claims handling is in our TriWest claim denials guide.

The offer is "free access to Experian IdentityWorks for 24 months," activated at experianidworks.com/1Bcredit with the code in the letter: "Enroll by October 31, 2026 by 11:59 p.m. UTC. Your code will not work after this date." The Breach Response Line is 1-833-918-1296, Monday through Friday, 8 a.m. to 8 p.m. Central. The membership includes "$1 Million Identity Theft Insurance"; a credit card is not required.

Express Scripts and Berkeley Research Group: 96,000, mostly without Social Security numbers

The DHA notice, posted May 13, 2026 as DHA Breach Reference 2026-BR-589, names Berkeley Research Group as "a consulting and litigation support firm engaged by Evernorth Federal Services (EFS), formerly Express Scripts." Someone "accessed BRG's computer systems between February 28 and March 2, 2025," and "EFS notified the Defense Health Agency (DHA) of this incident on March 12, 2026," more than a year later. About 96,000 beneficiaries were affected; "only 38 had their Social Security number involved." The letters carry instructions for "24 months of free Kroll credit monitoring." The notice closes in bold: "Beneficiaries who do not receive a letter were not affected and do not need to take any action."

What the stolen fields can reach: pay by rank

The DMDC files pair a Social Security number with a name and a date of birth, the three facts a lender, a bank or a password reset asks for. What those facts guard is below, from the DFAS 2026 pay table behind our Basic Pay 2026 tool. Direct deposit arrives as mid-month and end-of-month pay, so the third column is what lands on each pay date. Basic pay only: allowances add to the real deposit and taxes subtract from it, which the LES Auditor checks line by line.

No notice reports a diverted deposit or a misused record; the table is the stake, not a loss. The habit that protects it costs nothing: open the LES each pay period and confirm the direct deposit account, using our guide to reading your LES.

What federal law already gives you at no cost

A security freeze is free by statute. 15 U.S.C. 1681c-1(i) says a nationwide bureau "shall, free of charge, place the security freeze not later than" one business day after a phone or online request, and lift it within one hour. The FTC says it plainly: "There's no cost to place or lift a credit freeze." A freeze blocks a new account in your name; it does nothing for an account you already have, which is what monitoring and your own LES review cover.

An active duty alert, 15 U.S.C. 1681c-1(c), stays on the file "during a period of not less than 12 months," and per the FTC removes you from prescreened marketing lists for two years. The IDX page promises "a 90-day fraud alert"; the statute has set the initial alert at "not less than 1 year" since 2018, so expect the longer period. And 1681c-1(k) requires the bureaus to provide a "free electronic credit monitoring service" to an "active duty military consumer," which 1681a(q)(1) defines as a member on active duty, or a reservist on orders, who "is assigned to service away from the usual duty station," with (k)(1) adding "a member of the National Guard." That is separate from, and in addition to, the IDX, Experian and Kroll offers.

1. 1Find the letter and note its code, deadline and phone number. TriWest's cutoff is October 31, 2026; the DMDC letter says August 19, 2027.
2. 2Enroll through the printed address, never through a link in an email or text.
3. 3Freeze your file at all three bureaus; it is free and takes effect within one business day.
4. 4Read the LES every pay period and confirm the direct deposit account. If anything is wrong, file at identitytheft.gov and call the line on your letter.

Pay figures are the FY2026 DFAS table effective January 1, 2026; verify your own entitlement with your finance office before acting on any number here. Breach figures are as stated in the notices or by officials on the dates cited; the DMDC count may change when the Department publishes a release.