The breach that took 22 million background checks

The story

The US Office of Personnel Management, or OPM, manages records for federal employees. That includes background check forms filled in by people applying for security clearances, which ask about family, friends, past addresses, finances and more.

In June 2015, OPM announced a breach. In the end, about 22.1 million records were affected, including people who had undergone background checks and their family members and contacts. The stolen data included Social Security numbers, names, dates and places of birth, and addresses.

The breach involved two linked attacks. The first was discovered in March 2014. In the second, in May 2014, the attackers posed as an employee of a contractor that did background checks for the government. That second intrusion was not found until April 2015. The attack was widely attributed to hackers working for the Chinese government.

Why it mattered

It was one of the largest breaches of government data in US history. The stolen forms held some of the most personal information a person can give an employer, about their family, friends and finances, and unlike a password it can never be changed. The agency’s director resigned within weeks.

The lesson today

The attackers came in through a contractor’s identity and stayed for about a year. Businesses face the same risk with vendors and service accounts that have more access than they need. Knowing who has access to what, reviewing it regularly and watching for unusual activity limit how far a borrowed identity can go.