OPM hack: 21 million people's personal information stolen, federal agency says

Sensitive information including social security numbers concerning more than 21 million people was stolen last month when the Office of Personnel Management (OPM) was hacked, the US federal agency said on Thursday.

OPM launched a “forensic investigation” after discovering that its internal database, housing background-check records of current, former and prospective federal employees and contractors, had been hacked in late May.

Last week, the New York Times reported that the hack was conducted by Chinese hackers. China had previously denied involvement.

OPM houses personal information for all federal employees, including social security numbers; residency, employment and educational histories; “information about immediate family and other personal and business acquaintances”; health, criminal and financial histories and “other details”.

In a statement, the agency said the number of those affected by the hack included 19.7 million individuals who applied for a background investigation “and 1.8 million non-applicants, predominantly spouses or co-habitants of applicants”.

Anyone who has undergone a background check through OPM since 2000 “is highly likely” to be affected, the agency said. It is less likely, but still possible, that those who underwent background checks before 2000 would be affected.

Some OPM records also include findings from interviews and fingerprints. Usernames and passwords used to fill out application forms were also stolen, the agency said.

OPM said mental health records and financial histories were stored in separate systems, and there was no evidence that these had been impacted by the breach.

In its statement, OPM announced several steps it has taken and will take to “protect” those impacted by the breach, including providing identity theft insurance; identity monitoring for minor children; credit and fraud monitoring; and “full service identity restoration support and victim recovery assistance”.

These services will only be provided for free for three years.

The agency said it would send “notification packages” to those affected, which would include “educational materials and guidance to help them prevent identity theft, better secure their personal and work-related data and become more generally informed about cyber threats”.

Officials acknowledged to Congress last month that the OPM had failed for years to take basic steps to secure its computer networks.

“You failed utterly and totally,” said the House oversight and government reform committee chairman, Jason Chaffetz, a Republican. “They recommended it was so bad that you shut it down and you didn’t.”

On Thursday, Representative Adam Schiff, the Ranking Member of the House Permanent Select Committee on Intelligence, condemned OPM for not being “fully candid” with Congress and for omitting key information about “the breadth of the potential compromise.”

“Rather than simply place blame on the hackers, we need to acknowledge our own culpability in failing to adequately protect so obvious a target. Plainly, we need to do so much more to safeguard our networks,” said Schiff.

House speaker John Boehner, meanwhile, called for the OPM leadership to resign.

“After today’s announcement, I have no confidence that the current leadership at OPM is able to take on the enormous task of repairing our national security,” the Republican said in a statement.

Other Republicans, including House majority leader Kevin McCarthy and Senator John McCain, also called for the departure of OPM director Katherine Archuleta.

Archuleta said neither she nor OPM chief information officer Donna Seymour would resign.