2015Data breachEspionage
US Office of Personnel Management breach
Disclosed June to July 2015
Attackers stole personnel records and background investigation files held by the US Office of Personnel Management, including the detailed forms people complete for security clearances. A US House Oversight Committee report concluded the breach could have been prevented and that OPM leadership had not acted on repeated Inspector General recommendations.
- Victim
- US Office of Personnel Management
- Sector
- Government
- Public attribution
- No formal public attribution appears in the cited reports; this page makes none.
Impact
OPM said personnel data for 4.2 million people and background investigation records including Social Security numbers for 21.5 million people were stolen, in two related incidents.
Root cause
Long-standing security weaknesses on legacy systems, with recommendations from auditors left unaddressed, according to the House Oversight Committee.
Lessons learned: the controls it teaches
- Act on audit findings; known, documented weaknesses are what attackers exploit.
- Use strong authentication and modernise legacy systems that cannot support it.
- Minimise and segment highly sensitive data such as background investigation files.