On June 4, 2015, the U.S. Office of Personnel Management (OPM) revealed that a cyber intrusion into its information technology systems and data "may have compromised the personal information of [approximately 4.2 million] current and former Federal employees." Later in June, OPM reported a separate cyber incident, which it said had compromised its databases housing background investigation records and resulted in the theft of sensitive information of 21.5 million individuals. Officials do not believe that the intruders are still in the system. In the aftermath of the intrusions, Katherine Archuleta has stepped down as the director of OPM amid criticisms of how the agency managed its response to the intrusions and secured its information systems. Beth Cobert has taken on the role of acting director. In addition, OPM's Electronic Questionnaires for Investigations Processing (e-QIP) application, the "web-based automated system that was designed to facilitate the processing of standard investigative forms used when conducting background investigations," has been taken offline for "security enhancements." Uses of Stolen OPM Data

It remains unclear how data from the OPM breaches might be used if they are indeed now in Chinese government hands. Experts in and out of government suspect that "China may be trying to build a giant database of federal employees" that could help identify U.S. officials and their roles. For instance, compromised Social Security numbers and other personally identifiable information (PII) may be used for identity theft and financially motivated cybercrime, such as credit card fraud. The lack of stolen OPM data appearing in the criminal underworld has led some to speculate the breaches were more likely conducted for espionage rather than criminal purposes. If the IC's database were linked with OPM's, this could potentially help the hackers gain access to intelligence agency personnel and identify clandestine and covert officers. Protecting Federal Information Systems

The cybersecurity of most federal information systems is governed by the Federal Information Security Management Act (FISMA, 44 U.S.C. Â§3551 et seq. In addition, 40 U.S.C. A potential question for Congress is whether those and other provisions of law give agencies the legislative authority and resources they need to adequately address the risks of future intrusions. Congress is currently considering legislation to reduce perceived barriers to information sharing among private-sector entities and between them and federal agencies.
On June 4, 2015, the U.S. Office of Personnel Management (OPM) revealed that a cyber intrusion had impacted its information technology systems and data, potentially compromising the personal information of about 4.2 million former and current federal employees. Later that month, OPM reported a separate cyber incident targeting OPM's databases housing background investigation records. This breach is estimated to have compromised sensitive information of 21.5 million individuals.
Amid criticisms of how the agency managed its response to the intrusions and secured its information systems, Katherine Archuleta has stepped down as the director of OPM, and Beth Cobert has taken on the role of acting director. In addition, OPM's Electronic Questionnaires for Investigations Processing (e-QIP) application, the system designed to help process forms used in conducting background investigations, has been taken offline for security improvements.
Officials are still investigating the actors behind the breaches and what the motivations might have been. Theft of personally identifiable information (PII) may be used for identity theft and financially motivated cybercrime, such as credit card fraud. Many have speculated that the OPM data were taken for espionage rather than for criminal purposes, however, and some have cited China as the source of the breaches.
It remains unclear how the data from the OPM breaches might be used if they are indeed now in the hands of the Chinese government. Some suspect that the Chinese government may build a database of U.S. government employees that could help identify U.S. officials and their roles or that could help target individuals to gain access to additional systems or information. National security concerns include whether hackers could have obtained information that could help them identify clandestine and covert officers and operations.
The cybersecurity of most federal information systems is governed by the Federal Information Security Management Act (FISMA, 44 U.S.C. Â§3551 et seq.). Questions for policymakers include whether existing provisions of law give agencies the legislative authority and resources they need to adequately address the risks of future intrusions. In addition, effective sharing of cybersecurity information has been considered an important tool for protecting information systems from unauthorized intrusions and exfiltration of data. The 114 th Congress is considering legislation to reduce perceived barriers to information sharing among private-sector entities and between them and federal agencies.