OPM Says 5 Times More Federal Employees Had Fingerprint Data Stolen in Hack Than First Believed

The Office of Personnel Management says more fingerprint data was stolen in the massive breach of government employees files than first believed.

The number of federal personnel whose fingerprint data was stolen in the hack has increased from approximately 1.1 million people to 5.6 million, according to a statement Wednesday from OPM spokesman Samuel Schumach.

However, the latest revelation of exposed fingerprint data does not increase the overall number of people affected by the hack, which stands at about 21.5 million.

Along with fingerprint data, other purloined information includes Social Security numbers and sensitive data asked of federal employees and contractors applying for security clearances, such as financial history, drug use and sexual behavior.

OPM and the Defense Department made the discovery after “analyzing impacted data to verify its quality and completeness,” Schumach said.

It’s unclear how fingerprint data could be exploited by the hackers -- believed to be part of a Chinese espionage operation.

“Federal experts believe that, as of now, the ability to misuse fingerprint data is limited,” Schumach said in the OPM statement. “However, this probability could change over time as technology evolves. “

An interagency working group made up of the FBI, DoD, Homeland Security Department and members of the intelligence community “will review potential ways adversaries could misuse fingerprint data now and in the future,” as well as potential remedies, according to the statement.

“If, in the future, new means are developed to misuse the fingerprint data, the government will provide additional information to individuals whose fingerprints may have been stolen in this breach,” Schumach said.

An interagency team will continue to “analyze and refine the data” as the government prepares to mail notification letters to impacted employees and contractors.

The federal government inked an initial $133 million contract earlier this month -- five months after the breach was publicly disclosed --  to provide hack victims with three years of credit monitoring and identity-theft prevention services.

Working with the Defense Department, OPM will “begin mailing notifications to impacted individuals, and these notifications will proceed on a rolling basis,” Schumach said. Notifications are expected to begin later this month.

OPM has said any federal employee or contractor who has undergone a background investigation since 2000 is likely impacted by the breach.

The updated estimate of stolen fingerprints prompted anger from one of the fiercest Capitol Hill critics of OPM’s handling of the security breach.

“OPM keeps getting it wrong,” said Rep. Jason Chaffetz, R-Utah, the chairman of  the Oversight and Government Reform Committee, in a statement. “This breach continues to worsen for the 21.5 million Americans affected. I have zero confidence in OPM’s competence and ability to manage this crisis. OPM’s IT management team is not up to the task. They have bungled this every step of the way.”

In a statement, Sen. Ben Sasse, R-Neb., called the news -- coming amid the media frenzy over Pope Francis’ visit to Washington, D.C -- a “blatant news dump” and “the clearest sign yet that the administration still acts like the OPM hack is a PR crisis instead of a national security threat.”

(Image via Mark Van Scyoc/Shutterstock.com)