U.S. data hack may be 4 times larger than the government originally said

2015-06-25T03:38:54-04:00

Stand by to stand by. The OPM data hack may be much larger than originally thought. I'm personally still waiting to hear if my information got compromised (I do have an active TS/SCI security clearance) and this may be why.

Washington (CNN)The personal data of an estimated 18 million current, former and prospective federal employees were affected by a cyber breach at the Office of Personnel Management - more than four times the 4.2 million the agency has publicly acknowledged. The number is expected to grow, according to U.S. officials briefed on the investigation.

FBI Director James Comey gave the 18 million estimate in a closed-door briefing to Senators in recent weeks, using the OPM's own internal data, according to U.S. officials briefed on the matter. Those affected could include people who applied for government jobs, but never actually ended up working for the government.

Can Washington keep your data secure?

The same hackers who accessed OPM's data are believed to have last year breached an OPM contractor, KeyPoint Government Solutions, U.S. officials said. When the OPM breach was discovered in April, investigators found that KeyPoint security credentials were used to breach the OPM system.

Some investigators believe that after that intrusion last year, OPM officials should have blocked all access from KeyPoint, and that doing so could have prevented more serious damage. But a person briefed on the investigation says OPM officials don't believe such a move would have made a difference. That's because the OPM breach is believed to have pre-dated the KeyPoint breach. Hackers are also believed to have built their own backdoor access to the OPM system, armed with high-level system administrator access to the system. One official called it the "keys to the kingdom." KeyPoint did not respond to CNN's request for comment.

U.S. investigators believe the Chinese government is behind the cyber intrusion, which are considered the worst ever against the U.S. government.

Why would China hack the U.S. government?

OPM has so far stuck by the 4.2 million estimate, which is the number of people so far notified that their information was compromised. An agency spokesman said the investigation is ongoing and that it hasn't verified the larger number.

The actual number of people affected is expected to grow, in part because hackers accessed a database storing government forms used for security clearances, known as SF86 questionnaires, which contain the private information of multiple family members and associates for each government official affected, these officials said.

OPM officials are facing multiple congressional hearings this week on the hack and their response to it. There's growing frustration among lawmakers and government employees that the Obama administration's response has minimized the severity of breach.

OPM's internal auditors told a House Oversight and Government Affairs Committee last week that key databases housing sensitive national security data, including applications for background checks, had not met federal security standards.

"Not only was a large volume (11 out of 47 systems) of OPM's IT systems operating without a valid Authorization, but several of these systems are among the most critical and sensitive applications owned by the agency," Michael Esser, OPM's assistant inspector general for audits, wrote in testimony prepared for committee.

Katherine Archuleta, who leads OPM, is beginning to face heat for her agency's failure to protect key national security data -- highly prized by foreign intelligence agencies -- as well as for how slowly the agency has provided information.

Rep. Stephen Lynch, D-Mass., at a hearing last week told Archuleta: "I wish that you were as strenuous and hardworking at keeping information out of the hands of hacker as are at keeping information out of the hands of Congress."

http://www.cnn.com/2015/06/22/politics/opm-hack-18-milliion/index.html

U.S. government hack could actually affect 18 million - CNNPolitics.com

Personal data of an estimated 18 million employees was compromised by a recent hack of the U.S. government - four times what the agency has acknowledged.

Response by Capt Seid Waddell made Jun 25 at 2015 3:59 AM

2015-06-25T03:59:05-04:00

Surely this should have been caught sooner. A number of people had to have been asleep at the switch.

Response by SSG Ed Mikus made Jun 25 at 2015 12:25 PM

2015-06-25T12:25:49-04:00

As Capt Seid Waddell said this should have been caught sooner however, the issue is not where many people are trying to point. it has been my experience working in this field that the issue with security is often from decisions at the top level.
let's start with training, few people are aware enough of how do to proper risk assessments on the systems and data they have. You have to be aware of who targets your systems and what they may want.
This feeds into the budget, a risk assessment places a value (not always money) on the data and systems (CIA). This is how you know what to protect, the protect everything equally model is not practical, do you protect everything at your house equally? my guess is no, you have some things in your front yard out in the open, some items protected by a fence in your back yard while others are in the home, in a safe, or locked in a safety deposit box.
After everything is assessed management can separate IT and IT Security budgets allowing the better decisions on securing and manning security teams for the digital information systems.
Activity duty is leading the way on this while the rest of the federal government is dead last! I am currently in an Army Cyber Defense course and have discussed this at length with my classmates. there are several great ideas floating around about how to utilize the military cyber teams to defend the rest of the government however, we are not structured to do so currently nor do we have legal authority.
In short, the skills are likely there to secure the systems, the system failed to allow it to be secured by not assessing the threat correctly therefore not staffing and funding the defense of the systems.

Response by GySgt Wayne A. Ekblad made Jun 28 at 2015 4:42 AM

2015-06-28T04:42:49-04:00

Government logins widely available online ... maybe this is part of the problem?

http://www.federaltimes.com/story/government/cybersecurity/2015/06/25/fed-logins-online/29267693/

Government logins widely available online

Response by GySgt Wayne A. Ekblad made Jun 28 at 2015 9:56 AM

2015-06-28T09:56:13-04:00

Disorganized feds struggle with database security:

The government's failure to centralize database security was a key factor in the massive government hack now roiling the Obama administration.

Even after the damaging intrusion, believed to be from China and possibly affecting well over 18 million people, officials say the government is still struggling to fix the problem.

http://www.msn.com/en-us/news/politics/disorganized-feds-struggle-with-database-security/ar-AAcfjcn

Disorganized feds struggle with database security

The government's inability to centralize database security helped hackers get into the OPM network.

Response by CAPT Kevin B. made Jun 28 at 2015 11:08 AM

2015-06-28T11:08:23-04:00

I did the OPM identity theft thing that they will pay for 18 months. It should be paid for much longer. I haven't seen discussions of severing internet access to countries that sponsor hacking and spying. I guess that would mean killing it most everywhere including here. Implementation of CACs with random PIN number chips for all sensitive systems in all Agencies is long overdue. We'll have some spillage still, but not the wholesale open door policy we have now.