U.S. data hack may be 4 times larger than the government originally said
First on CNN: U.S. data hack may be 4 times larger than
the government originally said
By Evan Perez and Shimon Prokupecz, CNN
Updated 8:04 PM ET, Mon June 22, 2015
Story highlights
A data hack that the U.S. government says originated in
China may affect far more people than originally reported
The U.S. Office of Personnel Management still says the
hack could affect 4.2 million Americans
The FBI director told lawmakers the actual number could
be 18 million Americans
Washington (CNN)—The personal data of an estimated 18
million current, former and prospective federal employees were affected by a
cyber breach at the Office of Personnel Management - more than four times the
4.2 million the agency has publicly acknowledged. The number is expected to
grow, according to U.S. officials briefed on the investigation.
FBI Director James Comey gave the 18 million estimate in
a closed-door briefing to Senators in recent weeks, using the OPM's own
internal data, according to U.S. officials briefed on the matter. Those
affected could include people who applied for government jobs, but never
actually ended up working for the government.
The same hackers who accessed OPM's data are believed to
have last year breached an OPM contractor, KeyPoint Government Solutions, U.S.
officials said. When the OPM breach was discovered in April, investigators
found that KeyPoint security credentials were used to breach the OPM system.
Some investigators believe that after that intrusion last
year, OPM officials should have blocked all access from KeyPoint, and that
doing so could have prevented more serious damage. But a person briefed on the
investigation says OPM officials don't believe such a move would have made a
difference. That's because the OPM breach is believed to have pre-dated the
KeyPoint breach. Hackers are also believed to have built their own backdoor
access to the OPM system, armed with high-level system administrator access to
the system. One official called it the "keys to the kingdom."
KeyPoint did not respond to CNN's request for comment.
U.S. investigators believe the Chinese government is
behind the cyber intrusion, which are considered the worst ever against the
U.S. government.
OPM has so far stuck by the 4.2 million estimate, which
is the number of people so far notified that their information was compromised.
An agency spokesman said the investigation is ongoing and that it hasn't
verified the larger number.
The actual number of people affected is expected to grow,
in part because hackers accessed a database storing government forms used for
security clearances, known as SF86 questionnaires, which contain the private
information of multiple family members and associates for each government
official affected, these officials said.
OPM officials are facing multiple congressional hearings
this week on the hack and their response to it. There's growing frustration
among lawmakers and government employees that the Obama administration's
response has minimized the severity of breach.
OPM's internal auditors told a House Oversight and
Government Affairs Committee last week that key databases housing sensitive
national security data, including applications for background checks, had not
met federal security standards.
"Not only was a large volume (11 out of 47 systems)
of OPM's IT systems operating without a valid Authorization, but several of
these systems are among the most critical and sensitive applications owned by
the agency," Michael Esser, OPM's assistant inspector general for audits,
wrote in testimony prepared for committee.
Katherine Archuleta, who leads OPM, is beginning to face
heat for her agency's failure to protect key national security data -- highly
prized by foreign intelligence agencies -- as well as for how slowly the agency
has provided information.
Rep. Stephen Lynch, D-Mass., at a hearing last week told
Archuleta: "I wish that you were as strenuous and hardworking at keeping
information out of the hands of hacker as are at keeping information out of the
hands of Congress."
Comments
Post a Comment