Catching Up on the OPM Breach
Summary: Krebs on Security published a timeline of the OPM breach, tracing it from a July 2014 intrusion traced to China through a November 2014 Inspector General report finding 'significant' IT security deficiencies, to OPM's June 2015 disclosure of a breach affecting up to 4 million federal employees. The report found OPM lacked a comprehensive inventory of servers, databases and network devices, that auditors could not tell if OPM had a vulnerability scanning program, and that multi-factor authentication was not required to access OPM systems.
Bottom line: The OPM systems at issue process security clearance applications through e-QIP, holding applicants' financial histories, foreign contacts, and the names of neighbors and college roommates, with employees logging in using their Social Security numbers. The Inspector General's own report warned that the risk to federal employees and their families 'will probably linger long after the free credit monitoring offered by these companies expires.'
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026