The 22 million records that compromised the identities of American officials
In short: In 2015, a massive breach at the U.S. Office of Personnel Management exposed the private lives of millions. From fingerprints to family histories, the stolen data provided a treasure trove for foreign intelligence, leaving even the most seasoned secret agents vulnerable to identification.
The breach, one of the largest in U.S. history, targeted the Standard Form 86 (SF-86) records held by the Office of Personnel Management (OPM). These 127-page documents contain highly sensitive details, including psychological information, foreign contacts, and the personal histories of family members and roommates. The theft involved approximately 22.1 million records, affecting current and former federal employees, military personnel, and their families. Beyond names and Social Security numbers, the exfiltrated data included 5.6 million sets of fingerprints, a loss so significant that experts warned secret agents could be identified even if they changed their names.
The intrusion was not a single event but two linked attacks. The first, known as 'X1', was discovered on March 20, 2014. The second, 'X2', occurred on May 7, 2014, when attackers used the credentials of a subcontractor, KeyPoint Government Solutions, to penetrate the network. While there was conflicting reports regarding how the breach was detected—ranging from the Einstein intrusion-detection program to commercial forensic tools—it was ultimately found that OPM personnel detected the malicious code using Cylance software.
A consensus among investigators points to state-sponsored hackers from China, specifically the Jiangsu State Security Department. The attackers used the 'PlugX' malware and even used email handles referencing Marvel superheroes, 'Tony Stark' and 'Steve Rogers.' The fallout led to the resignations of OPI director Katherine Archuleta in July 2015 and CIO Donna Seymour in February 2016. Despite the scale of the theft, the investigation into the exact motivations remains unsettled, though some suggest the goal was to build a comprehensive database of Americans for intelligence purposes.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: 2015 Office of Personnel Management data breach
To cite this card, link to https://intellectplus.co.uk/app/places-2015-office-of-personnel-management-data-breach.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Countries and other regions · More in Countries & Cities · Latest · A–Z · All topics
