FILE - In this June 5, 2015, file photo, a gate leading to the Homeland Security Department headquarters in northwest Washington. Hackers stole personnel data and Social Security numbers for every federal employee, a government worker union said Thursday, June 11, 2015, charging that the cyberattack on U.S. employee data is far worse than the Obama administration has acknowledged. (AP Photo/Susan Walsh, File)

WASHINGTON (AP) — A major federal union says the cyber theft of employee information is more damaging than it first appeared, asserting that hackers stole personnel data and Social Security numbers for every federal employee.

The Obama administration had acknowledged that up to 4 million current and former employees are affected by the December cyber breach of Office of Personnel Management data, but it had been vague about exactly what was taken.

But J. David Cox, president of the American Federation of Government Employees, said in a letter Thursday to OPM director Katherine Archuleta that based on incomplete information OPM provided to the union, "we believe that the Central Personnel Data File was the targeted database, and that the hackers are now in possession of all personnel data for every federal employee, every federal retiree, and up to 1 million former federal employees."

The OPM data file contains the records of non-military, non-intelligence executive branch employees, which covers most federal civilian employees but not, for example, members of Congress and their staffs.

The union believes the hackers stole military records and veterans' status information, address, birth date, job and pay history, health insurance, life insurance, and pension information; and age, gender and race data, he said.

Also Thursday, Sen. Harry Reid of Nevada, the Democratic Senate leader, said that the hack was carried out by "the Chinese" without specifying whether he meant the Chinese government or individuals. Reid is one of eight lawmakers briefed on the most secret intelligence information. U.S. officials have declined to publicly blame China, which has denied involvement.

The union, which does not have direct access to the investigation, said it is basing its assessment on "sketchy" information provided by OPM. The agency has sought to downplay the damage, saying what was taken "could include" personnel file information such as Social Security numbers and birth dates.

"We believe that Social Security numbers were not encrypted, a cybersecurity failure that is absolutely indefensible and outrageous," Cox said in the letter. The union called the breach "an abysmal failure on the part of the agency to guard data that has been entrusted to it by the federal workforce."

Samuel Schumach, an OPM spokesman, said that "for security reasons, we will not discuss specifics of the information that might have been compromised."

Schumach did, however, address Cox's comment on encryption. "Though data encryption is a valuable protection method, today's adversaries are sophisticated enough that encryption alone does not guarantee protection," he said. "OPM does utilize encryption in some instances and is currently increasing the types of methods utilized to encrypt data."

The central personnel data file contains up to 780 separate pieces of information about an employee.

Cox complained in the letter that "very little substantive information has been shared with us, despite the fact that we represent more than 670,000 federal employees in departments and agencies throughout the executive branch."

The union's release and Reid's comment in the Senate put into sharper focus what is looking like a massive cyber espionage success by China. Sen. Susan Collins, R-Maine, an Intelligence Committee member, has also said the hack came from China.

Mike Rogers, the former chairman of the House Intelligence Committee, said last week that Chinese intelligence agencies have for some time been seeking to assemble a database of information about Americans. Those personal details can be used for blackmail, or also to shape bogus emails designed to appear legitimate while injecting spyware on the networks of government agencies or businesses Chinese hackers are trying to penetrate.

U.S. intelligence officials say China, like the U.S., spies for national security advantage. Unlike the U.S., they say, China also engages in large-scale theft of corporate secrets for the benefit of state-sponsored enterprises that compete with Western companies. Nearly every major U.S. company has been hacked from China, they say.

The Office of Personnel Management is also a repository for extremely sensitive information assembled through background investigations of employees and contractors who hold security clearances. OPM's Schumach has said that there is "no evidence" that information was taken. But there is growing skepticism among intelligence agency employees and contractors about that claim.

In the Senate on Thursday, Democrats blocked a Republican effort to add a cybersecurity bill to a sweeping defense measure. The vote was 56-40, four votes short of the number necessary.

Democrats had warned of the dangers of cyberspying after the theft of government personnel files, but Democrats voted against moving ahead on the legislation, frustrated with the GOP-led effort to tie the two bills together. President Barack Obama has threatened to veto the defense legislation over budget changes by the GOP.

"The issue of cybersecurity is simply too important to be used as a political chit and tucked away in separate legislation." said Sen. Chris Coons, D-Del.[source]

China Suspected in Massive Breach of Federal Personnel Data

FILE - This Feb. 24, 2015, file photo, shows the Homeland Security Department headquarters in northwest Washington. The Department of Homeland Security said in a statement Thursday, June 4, 2015, that data from the Office of Personnel Management and the Interior Department had been hacked. (AP Photo/Manuel Balce Ceneta, File)

WASHINGTON (AP) — China-based hackers are suspected of breaking into the computer networks of the U.S. government personnel office and stealing identifying information of at least 4 million federal workers, American officials said Thursday.
The Department of Homeland Security said in a statement that data from the Office of Personnel Management and the Interior Department had been compromised.
“The FBI is conducting an investigation to identify how and why this occurred,” the statement said.
The hackers were believed to be based in China, said Sen. Susan Collins, a Maine Republican.
Collins, a member of the Senate intelligence committee, said the breach was “yet another indication of a foreign power probing successfully and focusing on what appears to be data that would identify people with security clearances.”
A spokesman for the Chinese Embassy in Washington called such accusations “not responsible and counterproductive.”
“Cyberattacks conducted across countries are hard to track and therefore the source of attacks is difficult to identify,” spokesman Zhu Haiquan said Thursday night. He added that hacking can “only be addressed by international cooperation based on mutual trust and mutual respect.”
A U.S. official, who declined to be named because he was not authorized to publicly discuss the data breach, said it could potentially affect every federal agency. One key question is whether intelligence agency employee information was stolen. Former government employees are affected as well.
“This is an attack against the nation,” said Ken Ammon, chief strategy officer of Xceedium, who said the attack fit the pattern of those carried out by nation states for the purpose of espionage. The information stolen could be used to impersonate or blackmail federal employees with access to sensitive information, he said.
The Office of Personnel Management is the human resources department for the federal government, and it conducts background checks for security clearances. The OPM conducts more than 90 percent of federal background investigations, according to its website.
The agency said it is offering credit monitoring and identity theft insurance for 18 months to individuals potentially affected. The National Treasury Employees Union, which represents workers in 31 federal agencies, said it is encouraging members to sign up for the monitoring as soon as possible.
In November, a former DHS contractor disclosed another cyberbreach that compromised the private files of more than 25,000 DHS workers and thousands of other federal employees.
Cyber-security experts also noted that the OPM was targeted a year ago in a cyber-attack that was suspected of originating in China. In that case, authorities reported no personal information was stolen.
One expert said it’s possible that hackers could use information from government personnel files for financial gain. In a recent case disclosed by the IRS, hackers appear to have obtained tax return information by posing as taxpayers, using personal information gleaned from previous commercial breaches, said Rick Holland, an information security analyst at Forrester Research.
“Given what OPM does around security clearances, and the level of detail they acquire when doing these investigations, both on the subjects of the investigations and their contacts and references, it would be a vast amount of information,” Holland added.
DHS said its intrusion detection system, known as EINSTEIN, which screens federal Internet traffic to identify potential cyber threats, identified the hack of OPM’s systems and the Interior Department’s data center, which is shared by other federal agencies.
It was unclear why the EINSTEIN system didn’t detect the breach until after so many records had been copied and removed.
“DHS is continuing to monitor federal networks for any suspicious activity and is working aggressively with the affected agencies to conduct investigative analysis to assess the extent of this alleged intrusion,” the statement said.
Cybersecurity expert Morgan Wright of the Center for Digital Government, an advisory institute, said EINSTEIN “certainly appears to be a failure at this point. The government would be better off outsourcing their security to the private sector where’s there at least some accountability.”
Rep. Adam Schiff, ranking Democrat on the House intelligence committee, called the hack “shocking, because Americans may expect that federal computer networks are maintained with state of the art defenses.”
Ammon said federal agencies are rushing to install two-factor authentication with smart cards, a system designed to make it harder for intruders to access networks. But implementing that technology takes time.
Senate Intelligence Committee Chairman Richard Burr, R-N.C., said the government must overhaul its cybersecurity defenses. “Our response to these attacks can no longer simply be notifying people after their personal information has been stolen,” he said. “We must start to prevent these breaches in the first place.”[source]