21 million records hacked in government hack

Forum adverts like this one are shown to any user who is not logged in. Join us by filling out a tiny 3 field form and you will get your own, free, dakka user account which gives a good range of benefits to you:

No adverts like this in the forums anymore.
Times and dates in your local timezone.
Full tracking of what you have read so you can skip to your first unread post, easily see what has changed since you last logged in, and easily see what is new at a glance.
Email notifications for threads you want to watch closely.
Being a part of the oldest wargaming community on the net.

If you are already a member then feel free to login now.

**Frazzled**

I would expect the blackmailing to begin pronto.

http://www.nationaljournal.com/tech/hack-opm-office-personnel-management-cyber-million-20150709

OPM Announces More Than 21 Million Affected by Second Data Breach
The federal personnel agency announced Thursday a massive hack.
By Kaveh Waddell and Dustin Volz

The Office of Personnel Management Director Katherine Archuleta is sworn in before testifying to the Senate Homeland Security and Governmental Affairs Committee about the recent OPM data breach in the dirksen Senate Office Building on Capitol Hill June 25, 2015 in Washington, D.C.(Chip Somodevilla/Getty Images)

July 9, 2015

More than 21 million Social Security numbers were compromised in a breach that affected a database of sensitive information on federal employees held by the Office of Personnel Management, the agency announced Thursday.

That number is in addition to the 4.2 million social security numbers that were compromised in another data breach at OPM that was made public in June.

Of the 21.5 million records that were stolen, 19.7 million belonged to individuals who had undergone background investigation, OPM said. The remaining 1.8 million records belonged to other individuals, mostly applicants' families.

The records that were compromised include detailed, sensitive information about the individuals, including fingerprint data. OPM says 1.1 million compromised files included fingerprints.

Beyond the fingerprints and Social Security numbers, some of the files in the compromised database included "residency and educational history; employment history; information about immediate family and other personal and business acquaintances; health, criminal and financial history; and other details," OPM said.

Some records included "findings from interviews conducted by background investigators," and some included the usernames and passwords that applicants used to fill out investigation forms. And although separate systems that store health, financial, and payroll information do not appear to have been compromised, the agency says some mental health and financial information is included in the security clearance files that were affected by the hack.

This data breach, which officials have privately linked to China, began in May 2014, according to OPM Director Katherine Archuleta's testimony before Congress. It was not discovered until May 2015.

A security update applied by OPM and the Department of Homeland Security in January 2015 ended the bulk of the data extraction, according to congressional testimony from Andy Ozment, assistant secretary for cybersecurity and communications at DHS, even though the breach would not be discovered for months.

An OPM statement said that individuals who underwent background investigations in or after the year 2000 are "highly likely" to have had their information compromised in the breach. (This includes both new applicants and employees that were subject to a "periodic reinvestigation" during that time.) But those who were investigated before 2000 may also have been affected.

News of the second intrusion was first reported in June and was described as a potentially devastating heist of government data, as hackers seized extensive security-clearance information intelligence and military personnel. OPM said at the time that it became aware of the second hack while investigating the smaller breach that affected 4.2 million, which was disclosed earlier in June.

The size of the breach exceeds most of the estimates previously reported in various media outlets, including CNN, which said last month that the FBI believed 18 million people had been affected by the hack.

The personnel agency said Thursday that it has not seen any indication that the stolen information has been "misused" or otherwise disseminated.

On Wednesday, FBI Director James Comey refused to provide a specific number when asked by members of the Senate Intelligence Committee about the size of the breach. Comey did say the hack was "enormous," however, and confirmed that his own data had been compromised.

Several lawmakers in both parties have called for the resignations of Archuleta and Donna Seymour, the chief information officer at OPM, since the data breaches came to light last month. In a sharp statement Thursday after the numbers were revealed, House Oversight Chairman Jason Chaffetz reiterated his belief that the two "need to resign or be removed" from their posts.

"Since at least 2007, OPM leadership has been on notice about the vulnerabilities to its network and cybersecurity policies and practices," the Utah Republican said. "Director Archuleta and Ms. Seymour consciously ignored the warnings and failed to correct these weaknesses. Their negligence has now put the personal and sensitive information of 21.5 million Americans into the hands of our adversaries. Such incompetence is inexcusable. Again, I call upon President Obama to remove Director Archuleta and Ms. Seymour immediately."

But Archuleta has remained resolute in the face of withering scrutiny. During a Thursday press call, the one-time political director for President Obama's 2012 re-election campaign, said she and her staff should be applauded, not condemned, for their efforts to upgrade the agency's cybersecurity since she took office in November 2013.

"It is because the efforts of OPM and its staff that we've been able to identify the breaches," Archuleta said. When asked directly if she or Seymour would resign, Archuleta replied: "No."

**SilverMK2**

Sure it wasn't just the NSA?

**Co'tor Shas**

This pretty bad. It looks like my dad might have been one of the ones compromised too.

**cincydooley**

Co'tor Shas wrote:
This pretty bad. It looks like my dad might have been one of the ones compromised too.

fething awesome. How did he find out?

I've had background checks for teaching and through being bonded for most of my adult life....

**Frazzled**

I had a clearance decades ago.

"Look at this picture. The imperialist running dogs are clearly trying to train bears again. Jeesh thats one ugly bear..."

**Co'tor Shas**

cincydooley wrote:
Co'tor Shas wrote:
This pretty bad. It looks like my dad might have been one of the ones compromised too.

fething awesome. How did he find out?

I've had background checks for teaching and through being bonded for most of my adult life....

Not sure. He works for the NPS, so they probably told him.

**Jihadin**

Those effected will receive a letter from OPM informing them that their pertinent info was compromised.
OPM is linked into USAjobs so you are more then likely compromised if you applied for jobs on there

I've received the "Letter".
If one receives that particular letter do not throw it away. Store it.

**whembly**

Jesus Christ on a

pogo stick... the hack also includes an estimated over 1 million biometric data as well.

Could we please, get someone to head the OPM who's experience exceeds "2012 Obama National Compaign Manager"?

**LordofHats**

whembly wrote:

Could we please, get someone to head the OPM who's experience exceeds "2012 Obama National Compaign Manager"?

Because the government had such a wonderful track record with the internet before Obama, right?

Really, I wonder how many more major hacks can happen (they're coming in what, biweekly now?) before somebody says "guys, I hate to say it, but I don't think Windows Firewall is helping. We might need something stronger."

**Jihadin**

Its not serious enough yet
It gets serious when power grids goes off from a hack
A oil refinery locks open
Petrochemical company goes BOOM
Something will happen when lives are expended to make everyone care

**whembly**

LordofHats wrote:
whembly wrote:

Could we please, get someone to head the OPM who's experience exceeds "2012 Obama National Compaign Manager"?

Because the government had such a wonderful track record with the internet before Obama, right?

A) Blame anybody but Obama tactic already?

B) The OPM director was told, numerous times from IG that security need an overhaul.

Really, I wonder how many more major hacks can happen (they're coming in what, biweekly now?) before somebody says "guys, I hate to say it, but I don't think Windows Firewall is helping. We might need something stronger."

At this point, you'd have to assume that everyone who has worked or applied for Federal positions is compromised.

HEADS. NEEDS. TO. ROLL.

**LordofHats**

whembly wrote:

A) Blame anybody but Obama tactic already?

More like the "Why blame Obama for something that's been a glaring problem since the Clinton Administration?" tactic

US Government has always sucked with computers, which in the late 90's could probably be forgiven but come oooooooh, 2004? Probably a lot less understandable at that point

**whembly**

LordofHats wrote:
whembly wrote:

A) Blame anybody but Obama tactic already?

More like the "Why blame Obama for something that's been a glaring problem since the Clinton Administration?" tactic

US Government has always sucked with computers, which in the late 90's could probably be forgiven but come oooooooh, 2004? Probably a lot less understandable at that point

Alright... let's rephrased.

In the aftermath of this hack, let's get someone to head the OPM who's experience exceeds "2012 Obama National Campagin Manager"... m'kay?!?!

Frankly, I wonder if there needs to be a cabinet-level position in charge with operational IT security.

**Tannhauser42**

LordofHats wrote:
whembly wrote:

A) Blame anybody but Obama tactic already?

More like the "Why blame Obama for something that's been a glaring problem since the Clinton Administration?" tactic

US Government has always sucked with computers, which in the late 90's could probably be forgiven but come oooooooh, 2004? Probably a lot less understandable at that point

Exactly, and it's also a budget issue. Upgrading the systems and installing better security costs money. And OPM is one of those agencies that is always at the bottom of the list when the federal budget is worked on, because how many politicians actually care about the agency that handles hiring? It's not military, welfare, border security, homeland security, or law enforcement so nobody in Congress cares...until something like this happens to make them care.

**JNC**

Seems like this is not really important. I have to wonder if they used the information as bait. What good would the info do? We got it boss, now what?

Steal some juicy stuff already, not impressed.

EDIT----From the viewpoint of DMG to the country, not the people involved. I agree ID theft needs to be adressed in our society, it is becoming too common. The system was sloppy from the get-go

**Jihadin**

One of things indicated in OPM is security level one has

**Sasori**

JNC wrote:
Seems like this is not really important. I have to wonder if they used the information as bait. What good would the info do? We got it boss, now what?

Steal some juicy stuff already, not impressed.

NSA wants to hire the guys?

Uh, it's pretty important to the people their information stolen. Do you know how exhaustive an SF86 and investigation can be? It's pretty much your entire life. There are plenty of things criminals can use this for.

If this was sarcasm, fair play.

**Frazzled**

US Government has always sucked

Fixed your quote.

**-Shrike-**

LordofHats wrote:
whembly wrote:

Could we please, get someone to head the OPM who's experience exceeds "2012 Obama National Compaign Manager"?

Because the government had such a wonderful track record with the internet before Obama, right?

Really, I wonder how many more major hacks can happen (they're coming in what, biweekly now?) before somebody says "guys, I hate to say it, but I don't think Windows Firewall is helping. We might need something stronger."

I didn't see that as an attack against Obama, I saw it as pointing out that the current head of the computer based management section of the US government doesn't seem to have many computer security related qualifications.

**jhe90**

You spend billions on useless projects at times, why not rout some of that money into setting up a decent security system which can be used in various forms across agency's and sectors to provide a high level of security across the board.

Save every department developing there own systems and maybe even reduce costs.

Oh wait that's too sensible.

**Frazzled**

Exactly. You must not be familiar with government operations...

**djones520**

Awesome... so that sounds like me, and possibly my wife.

Thanks government. So glad you could dick me over again.

On the bright side of things, 25 million people over all, the odds of my number getting picked to be used in fraud is pretty slim.

**cincydooley**

jhe90 wrote:
You spend billions on useless projects at times, why not rout some of that money into setting up a decent security system which can be used in various forms across agency's and sectors to provide a high level of security across the board.

Save every department developing there own systems and maybe even reduce costs.

Oh wait that's too sensible.

Cronyism at it's finest. That's why a company with a less than stellar track record received the ACA contract instead of Google, who offered to do it for less.....

Happens with all of our administrations.

**whembly**

This may come to a shock to ya'll...

But, I'm pretty much at the point where Congress needs to authorize a quasi private/public organization like the Federal Reserve to oversee this nation's IT Security.

Automatically Appended Next Post:
EDIT:

BREAKING: Embattled OPM Director Katherine Archuleta resigns in wake of revelations about massive hack of govt computer systems

— Julie Davis (@juliehdavis) July 10, 2015

Good. Now don't sweep this under the rug Feds. fething fix this.

**Co'tor Shas**

Let's hope so. This had been a problem with all levels of government for years. It's a massive security risk, and I think deserving of special action from congress to supply funds to fix it.

**Breotan**

Jihadin wrote:
Those effected will receive a letter from OPM informing them that their pertinent info was compromised.

Assuming they have correct addresses. I can only imagine such a letter trying to reach me.

**streamdragon**

whembly wrote:
But, I'm pretty much at the point where Congress needs to authorize a quasi private/public organization like the Federal Reserve to oversee this nation's IT Security.

right, because private and quasi private organizations have never been hacked... ever.

The simple thing is that OPM has been asking for money for nearly a decade to upgrade their systems. Congress wouldn't give them money and in some budgets slashed their funding. What did people thing was going to happen?

**Jihadin**

Breotan wrote:
Jihadin wrote:
Those effected will receive a letter from OPM informing them that their pertinent info was compromised.

Assuming they have correct addresses. I can only imagine such a letter trying to reach me.

IRS has your current addre3ss do they not?

Edit

Address

**Tannhauser42**

OPM was a nobody agency that nobody in Congress cared about because it wasn't a part of any political agenda. They're so far down on the list of priorities that their budget is already small (only $240 million for 2015, that's less than 4% of what the military gets). But now Congress cares about it, because something big happened.

I wonder which agency will be next? There are quite a lot more unimportant agencies that Congress doesn't care about that could suddenly become very important if something big happens to them.

Think about this, in 2015 the US spent $620 billion on its military, Russia spent $84 billion on their military, and China spent $131 on their military (assuming my Google-Fu is strong). And who's kicking whose ass in cyberspace?

**whembly**

streamdragon wrote:
whembly wrote:
But, I'm pretty much at the point where Congress needs to authorize a quasi private/public organization like the Federal Reserve to oversee this nation's IT Security.

right, because private and quasi private organizations have never been hacked... ever.

The simple thing is that OPM has been asking for money for nearly a decade to upgrade their systems. Congress wouldn't give them money and in some budgets slashed their funding. What did people thing was going to happen?

Hence, make such position/department fething important.

It's not JUST the OPM... it's everything at the federal level (minus NSA/CIA/Military... they have their gak together).

EDIT: oh... and another point as to how disasterous this is...

The Federal Judicial Judges and Staff were in this hack.