OPM Awards $416M Contract for Protection Services to Hack Victims

The Office of Personnel Management has awarded a new contract to provide more than 20 million hack victims with credit monitoring and identity theft protections, selecting the same company that has delivered those services for the last three years.

The new ID Experts contract, which took effect Jan. 1, will initially last through June 2020, but can be extended to last for five years. It worth up to $416 million if those options are exercised and will provide protections for 22.1 million current and former federal employees, contractors and their relatives. OPM already spent $340 million on the initial contract to ID Experts.

That agreement lasted only for three years, but Congress has since mandated that hack victims receive 10 years of protections. An OPM spokesperson previously told Government Executive that if ID Experts were once again selected, then “there will be no change to the enrolled population.”

The Government Accountability Office has criticized OPM for overpaying for the services, saying the level of coverage is “likely unnecessary” and may be distorting the identity theft insurance market.

ID Experts will provide protections to victims of two different breaches unveiled in 2015. The first exposed personnel files of 4.2 million current and former federal employees and the second involved the personal information in background investigations of 21.5 million employees, contractors, applicants and family members. About 3.4 million people signed up for the protections as of 2016, according to OPM.

"ID Experts is excited to continue our service to OPM in providing identity protection services for the approximately 22.1 million individuals impacted by the 2015 cyber incidents,” said Tom Kelly, the company’s CEO. “Protecting those who serve our nation will always be a top priority for the entire ID Experts team.”

After the breaches, the General Services Administration announced a blanket purchase agreement that prescreened potential vendors for identity theft protection services for federal agencies. Three companies were included in the purchase agreement, which lasts through August 2020. In addition to ID Experts, GSA identified Massachusetts-based Identityforce and Michigan-based Ladlas Prince for prioritized selection.

Hack victims enrolled in the program are currently receiving a “suite of services,” including full-service identity restoration support and victim recovery assistance, identity theft insurance, identity monitoring for minor children, continuing credit monitoring and fraud monitoring services beyond credit files. They also are eligible for up to $5 million in identity theft insurance. ID Experts was required to establish call centers that operate 12 hours per day, six days per week.

Some lawmakers have pushed for hack victims to receive lifetime protections, and federal employee groups are fighting for that outcome in federal court. There are no known, verified instances of OPM data being released to criminals.