A union representing U.S. government workers says it believes detailed personal information on millions of current and former federal employees that was stolen by hackers was not encrypted.
The American Federation of Government Employees (AFGE) said the attack on the Office of Personnel Management (OPM) resulted in the theft of all personnel data for every federal employee.
In a letter sent Thursday to Katherine Archuleta, director of the OPM, from David Cox, president of the AFGE, the union says it believes hackers targeted the government’s Central Personnel Data File, an expansive database with information on government workers except those in the military or intelligence fields.
The OPM has acknowledged a breach affecting around 4 million [m] people, but hasn’t provided detailed information on what was stolen, how it was stored and how hackers managed to break into its system.
“We believe that hackers have every affected person’s Social Security number, military records and veterans’ status information, address, birth date, job and pay history, health insurance, life insurance, and pension information; age, gender, race, union status, and more,” Cox wrote in the letter, a copy of which was provided to IDG News Service. “Worst, we believe that Social Security numbers were not encrypted, a cybersecurity failure that is absolutely indefensible and outrageous.”
In response to the breach, OPM offered free credit monitoring for 18 months to affected employees—an offer the union called “entirely inadequate.” The AFGE called for lifetime credit monitoring and asked OPM to work with government departments to relax rules on personal use of government computers so employees could access websites to help deal with the breach.