The Pentagon is dealing with a breach of Department of Defense travel records that exposed the personally identifiable information of defense personnel, a department spokesman said Friday evening.

Pentagon officials on Oct. 4 identified a breach of the personally identifiable information (PII) of DOD personnel “that requires congressional notification,” Lt. Col Joe Buccino, a Pentagon spokesman, said in a statement.

“The department is continuing to assess the risk of harm and will ensure notifications are made to impacted personnel whose PII may have been compromised,” Buccino said.

The breach involves a single commercial vendor — the name of which was not released — that provided DOD with a small percentage of travel management services, he added.

The Associated Press, which was first to report the news, reported that the breach could have affected up to 30,000 DOD workers and that the number could grow as the investigation proceeds.

Buccino told CyberScoop that he could not confirm that number at this time.

“The department is continuing to gather additional information about the incident,” Buccino said.