Chaffetz releases report on OPM data breach

Under the leadership of U.S. Rep. Jason Chaffetz (R-UT), the House Oversight and Government Reform Committee released a report on Wednesday on the Office of Personnel Management’s (OPM) 2015 data breach.

The report, titled “The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation,” details the committee’s yearlong investigation into the 2015 data breach that compromised the personal data of millions.

The report found that the data breach was preventable, OPM leadership failed to follow recommendations from its inspector general and failed to identify growing threats, and that OPM misled the public about the extent of the breach’s damage.

Chaffetz, the chairman of the committee, and U.S. Rep. Mike Turner (R-OH) requested that Comptroller General Gene Dodaro render an opinion about whether the OPM violated the Antideficiency Act (ADA) following the conclusion of the investigation.

“In brief, we believe OPM violated the ADA when the agency retained and deployed CyTech’s software following a product demonstration, and never paid,” Chaffetz and Turner wrote in a letter to Dodaro. “On April 21, 2015, CyTech demonstrated its CyFIR tool at OPM’s headquarters in Washington, D.C. Following the demonstration, OPM staff represented they intended to purchase licenses to deploy CyTech’s software in various places throughout the agency. The next day, CyTech, relying on the government’s verbal request, began expanding the scope of the software services that were installed for the demonstration and provided a license to OPM for 1,000 endpoints that expired on June 30, 2015.”

Turner said that the multiple security breaches suffered by OPM in 2014 and 2015 allowed the sensitive records of 20 million government personnel to be compromised by hackers.

“These breaches compromised the security clearance background investigation information of 21.5 million individuals, putting at risk the fingerprints, current and past addresses, family members’ names and dates of birth, and other personal information of our national security personnel,” Turner said. “(Wednesday’s) letter continues my efforts with Chairman Chaffetz to hold OPM accountable to these employees, retirees, and their families.”