Congressional Reports Find OPM Security Measures Failed Resulting in 2014 Intrusion

If you haven’t heard, the U.S. Government’s Office of Personnel Management (OPM) was the victim of a data breach back in 2014-2015. In that incident, sensitive information including names, dates of birth, social security numbers and a lot more was stolen for over 20.5 million people. New information is now appearing claiming that while the first hacker in the incident was followed and tracked and ultimately booted out of the system, there was a second hacker, they are calling “Hacker X2” who remained in the system until far later. This hacker ended up using stolen credentials from a contractor and installed malware and a backdoor which resulted in the theft of personnel records and fingerprint data. The Chinese government is being accused of being somehow involved.

If you were a victim of this intrusion, you should have received some notification from the U.S. Government. As a part of its attempt to calm the nerves of the victims, it offered identity theft protection services. If you have not signed up, take some time to do so now. While it won’t prevent your information from being used, notifications will be sent letting you know if someone tries to access your credit or if something suspicious occurs. The sooner you get a notification, potentially the less damage to your identity can happen. More information can be found on the OPM website.

In addition, check your credit reports independently of that service using the government-backed annual credit report service. Everyone with credit in the U.S. is entitled to one report free each year from each of the three major credit bureaus: Experian, Equifax, and TransUnion. You can order them all at once, but it’s recommended that you get one every four months. These organizations share information, so if something appears on one report, you can react much quicker to it, rather than having to wait a whole year to check it again.

The OPM and the federal government are coming under intense scrutiny by Congress as well as the public for not doing enough to protect those for which it stores information. However, a number of steps have been taken with regard to strengthening IT security such as implementing some “cutting-edge” cyber security tools. However, per a congressional report, some more basic actions that could have helped significantly include multi-factor authentication for those using the government networks and more stringent vetting of government contractors. While these may be in the plans of the OPM leadership, considering the size and responsibility of the government, any change, no matter how effective will take time and funding. Neither of which move quickly, or perhaps adequately, in this country. Patience is certainly required.