Loading story…
U.S. lawmakers have introduced the bipartisan RECOVER PII Act to provide lifetime identity-protection services to people affected by the 2015 Office of Personnel Management breaches, replacing benefits that are set to expire after the current 10-year coverage period. The proposal comes before existing protection for enrollees in the MyIDCare program begins ending on Sept. 30, and would preserve at least $5 million in identity-theft insurance for affected individuals.
The OPM intrusions exposed highly sensitive personnel and background-investigation records tied to about 22.1 million current, former, and prospective federal employees, contractors, and others. Supporters of the bill, including Sen. Mark Warner and Del. Eleanor Holmes Norton, say the stolen data still poses long-term personal and national security risks because foreign intelligence services can retain and correlate the records over time to identify or target government personnel and their families; the legislation would also let agencies reimburse workers for privacy tools and online information-removal services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In 2017, Congress responded to the OPM breach through an appropriations law requiring OPM to provide at least 10 years of complimentary identity-protection services to victims. The law also required no less than $5 million in identity-theft insurance for affected individuals.
The Office of Personnel Management breaches were disclosed in 2015 and compromised personnel records and background-investigation data affecting roughly 22.1 million current, former, and prospective federal employees, contractors, and others. One intrusion exposed about 4.2 million personnel records, while another compromised 21.5 million background-investigation records, with about 3.6 million people affected in both incidents.
Sen. Mark Warner and Del. Eleanor Holmes Norton are introducing the RECOVER PII Act, with Sens. Tim Kaine, Angela Alsobrooks, and Chris Van Hollen as Senate cosponsors. The bill would replace the current 10-year limit on identity-protection services for OPM breach victims with lifetime coverage, preserve identity-theft insurance, and allow agencies to reimburse workers for privacy tools and online information-removal services.
Some people enrolled in OPM's MyIDCare program began receiving notices late last year that their complimentary identity-protection coverage would end 10 years after their enrollment date. The notices are expected to continue through September as the program winds down.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcescworld.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Identity theft protection services for victims of the 2015 Office of Personnel Management breach are beginning to expire 10 years after enrollment, closing a major federal remediation effort tied to one of the most damaging U.S. government cyber intrusions. The breach affected more than **22.1 million** people, including federal employees, security-clearance applicants, and family members, across two incidents involving personnel records and background-investigation data; the intrusions were widely assessed as linked to China. OPM first offered three years of coverage, then expanded benefits to 10 years under the **Consolidated Appropriations Act of 2017**, with contracts worth hundreds of millions of dollars awarded to **ID Experts**, now **IDX**. OPM said it considered extending the program but decided against it because of high costs and low recent claims, while the Government Accountability Office had argued the coverage was excessive and could distort the market. A **2022 class-action settlement** set aside **$63 million** for hardship claims, but only about **$4.8 million** was paid to just over **5,000** people before the remaining funds were returned to the U.S. Treasury. The expiration has drawn mixed reactions from affected individuals, with some warning that the stolen data could create lifelong risk, while others say a decade of support was sufficient; some recipients also reported follow-up marketing from IDX encouraging them to buy continued coverage on their own.
Jun 29, 2026
Hackers tied by multiple reports to China penetrated the U.S. Office of Personnel Management and accessed some of the government’s most sensitive personnel systems, including databases linked to federal employee records and the `e-QIP` security-clearance platform. What was first described in 2014 as a detected intrusion later emerged as one of the most damaging breaches of U.S. government networks: authorities said the attackers compromised records on **22.1 million people**, including current and former federal workers, contractors, applicants, and others connected to background investigations. The stolen data included Social Security numbers, health and financial details, background-investigation forms, and **5.6 million fingerprints**, raising fears that the information could be used to build long-term intelligence dossiers on U.S. personnel. The breach triggered resignations, congressional scrutiny, and years of criticism over OPM’s security failures. OPM Director Katherine Archuleta resigned after the scale of the compromise became clear, and CIO Donna Seymour later stepped down amid pressure from lawmakers and investigators. Reports said the intrusion was discovered during a security product demonstration, while watchdogs accused OPM officials of obstructing parts of the investigation and the Government Accountability Office later found that dozens of recommended fixes remained incomplete years after the attack, including weaknesses around passwords, shared administrative accounts, and contractor oversight.
Jun 29, 2026
A new bipartisan House bill, the **Stop Identity Fraud and Identity Theft Act**, would put the US Treasury Department in a central coordinating role to reduce identity theft and identity-related fraud by strengthening digital identity infrastructure. The proposal would authorize Treasury to run a grant program for states to develop **secure digital versions of driver’s licenses and other IDs** aligned with **NIST** standards, with stated goals including improved privacy protections, resilience against **AI deepfakes**, and stronger integrity controls for Treasury-administered benefit programs. Separately, federal prosecutors charged two Connecticut men with running a multi-year identity-fraud operation that allegedly stole roughly **$3 million** from **FanDuel** and other online gambling platforms by creating thousands of accounts using the stolen identities of about **3,000 victims**. Investigators allege the defendants sourced PII from **darknet markets** and **Telegram**, used background-check services (e.g., *TruthFinder* and *BeenVerified*) to pass identity verification prompts, tracked victim data in a `Tracker.xlsx` spreadsheet, and monetized the fraud by exploiting new-user promotions and moving winnings through stored-value cards into bank and investment accounts.
Jun 29, 2026