The types of harm that can result from exposure of sensitive  personal information include the following:
Financial fraud from identity theft, which can include new-account fraud, in which thieves use identifying data, such as  Social Security and driver’s license numbers, to open new  financial accounts without that person’s knowledge; and, existing-account fraud, which is more common and entails the  use or takeover of existing accounts, such as credit or debit card  accounts, to make unauthorized charges or withdraw money. Harm from state-based actors. Identity theft services most often include credit monitoring, which tracks an individual’s credit reports and  sends alerts about potentially suspicious activity;  identity monitoring, which aims to monitor other sources such as  public records and illicit websites (sometimes referred to as the  “dark web”);  identity restoration, which provides a range of services to  recover from identity theft; and  identity theft insurance, which reimburses individuals for certain  costs related to the process of restoring identities. Limited Information Is Available on Effectiveness of Options after Data Breaches, but Credit Freezes Can Prevent New-Account Fraud

We did not identify any studies that analyzed whether consumers who  sign up for or purchase identity theft services encounter fewer instances  of identity theft or detect instances of financial or other fraud more—or  less—rapidly than consumers who take steps on their own. No Independent Research Assesses Effectiveness of Consumer Options to Address Risks after Data Breaches

Information that can help consumers assess their options for mitigating  and addressing the risks of identity theft and other harm from data  breaches is limited. Specifically, we did not identify any studies that  analyzed whether consumers who sign up for free or purchase identity  theft services encounter fewer instances of identity theft or detect  instances of financial or other fraud more—or less—rapidly than  consumers who take steps on their own for free—such as monitoring their  credit reports or placing a credit freeze. Government and commercial entities—such as federal agencies and  retail stores—that decide to purchase identity theft services to offer to  affected individuals after a breach of their data do not necessarily base  their decision on how effective these services are. No one solution  can protect against the full range of risks to individuals whose personal  information was exposed in a data breach, based on our review of  documentation and the views of academic, consumer, government, and  industry experts. In addition, a few consumer group  representatives indicated that consumers could consider signing up for  such services if they are offered for free. Identity theft services also may be of limited  value in cases of nation-state espionage. Importance of data security. A few experts said that  the burden should not be on consumers to protect data they do not  control. Finally, consumer group and government researchers we interviewed  suggested other options that entities can (or already) use to address risks  of harm. For example,  consumers still have to lift a freeze before applying for a loan or new  credit account and need to place or remove a freeze at each consumer  reporting agency separately, which could cause delays for consumers  actively shopping for a home, car, or other purchase requiring the  extension of credit. Convenience. Type of information at risk. Approximately 13 percent of those affected by the 2015 OPM breaches  used credit and identity monitoring and identity restoration services that  OPM offered them and a fraction of a percent made identity theft  insurance claims (the payouts for which averaged $1,800). Data we  assessed for this report support a 2017 recommendation we made to the  Office of Management and Budget (OMB) to revise guidance to federal  agencies about responding to data breaches and one to Congress to  consider permitting agencies to determine appropriate levels of identity  theft insurance offered after data breaches. FTC updates the information regularly, such as after large-scale  data breaches. Customized assistance (IdentityTheft.gov). Few affected individuals have used the services. According to data from  OPM, as of September 30, 2018, close to 3 million, or 13 percent, of  individuals affected by the 2015 incidents had made use of the services. Since 2015, OPM has obligated approximately $421 million for identity  theft services and as of November 30, 2018, OPM paid out approximately  $361 million of the obligated funds. The contract to provide these  services on behalf of OPM expired in December 2018; OPM re-competed  and awarded a single contract that month to ID Experts, the company that  had been providing these services. Appendix I: Objectives, Scope, and Methodology

This report examines (1) information and expert views about the  effectiveness of options consumers can use to prevent or address the  risks resulting from data breaches; and (2) federal assistance available to  help consumers understand these options, including the status of one  matter for congressional consideration and one recommendation relating  to these issues in our 2017 report. To ensure the selection of a range of perspectives on the effectiveness of  options to mitigate harms, we reviewed the selection of experts and  sources in our prior report and our literature review, and updated that  selection through additional searches and recommendations from  discussions with experts and identity theft service providers and review of  relevant literature.
Why GAO Did This Study

Recent large-scale data breaches of public and private entities have put hundreds of millions of people at risk of identity theft or other harm. GAO was asked to review issues related to consumers' options to address risks of harm from data breaches. This report, among other things, examines information and expert views on the effectiveness of consumer options to address data breach risks. GAO analyzed available data on options, collected and analyzed related documentation, conducted a literature review of studies, and interviewed a nongeneralizable sample of 35 experts (from academia, government entities, consumer and industry organizations) and identity theft service providers to reflect a range of views.

What GAO Found

No one solution can address the range of potential risks from a data breach, according to interviews with academic, consumer, government, and industry experts and documentation GAO reviewed. Perpetrators of fraud can use stolen personal information—such as account numbers, passwords, or Social Security numbers—to take out loans or seek medical care under someone else's name, or make unauthorized purchases on credit cards, among other crimes. Foreign state-based actors can use personal information to support espionage or other nefarious uses.
Public and private entities that experience a breach sometimes provide complimentary commercial identity theft services to affected individuals to help monitor their credit accounts or restore their identities in cases of identity theft, among other features. Consumers also may purchase the services. As of November 30, 2018, the Office of Personnel Management (OPM) had obligated about $421 million for a suite of credit and identity monitoring, insurance, and identity restoration services to offer to the approximately 22 million individuals affected by its 2015 data breaches. As of September 30, 2018, about 3 million had used the services and approximately 61 individuals had received payouts from insurance claims, for an average of $1,800 per claim. OPM re-competed and awarded a contract to the previously contracted company in December 2018.
GAO's review did not identify any studies that analyzed whether consumers who sign up for or purchase identity theft services were less subject to identity theft or detected financial or other fraud more or less quickly than those who monitored their own accounts for free. A few experts said consumers could sign up for such services if offered for free. Credit monitoring may be convenient for consumers and personalized restoration services may help identity theft victims recover their identities, but such services do not prevent fraud from happening in the first place. The services also do not prevent or directly address risks of nonfinancial harm such as medical identity theft.
Consumer, government, and industry experts highlighted other free options, including a credit freeze, which prevents one type of fraud. A freeze restricts businesses from accessing a person's credit report—and can prevent the illicit opening of a new account or loan in the person's name. A provision of federal law that took effect in September 2018 made it free for consumers to place or lift credit freezes quickly at the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion). Consumers also can regularly monitor their accounts and review their credit reports for free every 12 months. In addition, they can take advantage of free federal assistance such as the guidance on the Federal Trade Commission's IdentityTheft.gov website.
Finally, large amounts of personal information are outside of consumers' control and bad actors can use stolen information for years after a breach. Therefore, experts noted that data security at entities that hold such information—and efforts to make stolen information less useful for identity thieves, through use of new identity verification technologies, for example—are important ways to mitigate risks of harm for consumers.

What GAO Recommends

GAO reiterates a matter for congressional consideration and a recommendation from its 2017 report on identity theft services ( GAO-17-254 ). In that report, GAO found that legislation requiring federal agencies that experience data breaches, including OPM, to offer certain levels of identity theft insurance coverage to affected individuals requires coverage levels that are likely unnecessary. Therefore, Congress should consider permitting agencies to determine the appropriate coverage level for such insurance. GAO also recommended the Office of Management and Budget (OMB) update its guidance for agency responses to data breaches, after analyzing the effectiveness of identity theft services relative to lower-cost alternatives. OMB did not agree or disagree and had not taken action as of early March 2019.