Between May 2014 and the summer of 2015, the U.S. Office of Personnel Management (OPM) and its contractor, Peraton Risk Decision Inc., experienced data breaches compromising the personal information of various individuals connected to the federal government. The incidents allegedly involved unauthorized access to sensitive data and impacted many people, resulting in a lawsuit. The defendants have denied any wrongdoing but have agreed to settle the case.

How many accounts were compromised?

The breach impacted data related to approximately 22 million individuals.

What data was leaked?

The data exposed in the breach included security clearance records, personally identifiable information such as Social Security numbers, names, dates and places of birth, and addresses, as well as personal information of then-current and former federal government employees and contractors, and certain applicants for federal employment.

How was OPM hacked?

The hackers responsible for the OPM data breach gained valid user credentials, likely through social engineering, and used a malware package called PlugX to establish a backdoor within OPM's network. From there, they escalated their privileges to access a wide range of systems, ultimately compromising sensitive information such as security clearance records and personally identifiable information.

OPM's solution

In response to the hack, OPM took several measures to secure its platform and prevent future incidents. Although specific enhanced security measures remain unclear, OPM made free credit monitoring and identity theft protection services available to all individuals whose personal information was compromised in the data breaches. The FBI and the Department of Homeland Security were involved in the investigation of the breach, and OPM provided resources for affected individuals to enroll with a service provider for additional protection. However, details regarding the removal of malware and backdoors, as well as any encouragement to change passwords, are not explicitly mentioned.

How do I know if I was affected?

OPM has not explicitly mentioned reaching out to affected users. However, if you believe you may have been affected by the OPM data breach and have not received any notification, you can visit HaveIBeenPwned to check your credentials.

What should affected users do?

In general, affected users should:

• Change Your Passwords: Immediately update your passwords for all affected accounts. Make sure the new passwords are strong and unique, not previously used on any other platform.

• Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

• Enable Two-Factor Authentication (2FA): Activate 2FA on all affected accounts. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

• Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report any unauthorized access or transactions to the appropriate authorities.

For more specific help and instructions related to OPM's data breach, please contact OPM's support directly.

Where can I go to learn more?

If you want to find more information on the OPM data breach, check out the following news articles:

• U.S. Suspects Hackers in China Breached About 4 Million People's Records