A huge batch of sensitive data such as SSNs of over 21 million people leaked in June during the hack of the Office of Personnel Management, the US federal agency.

The Office of Personnel Management started an investigation after it turned out that its internal database containing background checks of current, former and prospective federal employees and contractors had been breached in late spring 2015. Shortly after the breach, the US authorities claimed that the hack was conducted by Chinese hackers, while China denied involvement.

The Office of Personnel Management stores personal data for all federal employees, including SSNs, residency, employment and educational records, data about immediate family, health, criminal and financial records. After the investigation, the federal agency issued a statement saying that the number of affected employees included 19.7m people who applied for a background investigation plus 1.8m non-applicants, mostly spouses or co-habitants of applicants. In other words, virtually anyone who has undergone a background check through the agency since 2000 was affected. Besides, the chances are that people who underwent background checks before 2000 can also be affected.

The Office of Personnel Management admitted that usernames and passwords used to fill out application forms were also stolen, as well as records containing findings from interviews and fingerprints. However, the good news is that mental health records and financial histories were stored separately and appear safe.

The federal agency announced a number of steps taken and planned to protect people affected by the breach. For example, it provided free identity theft insurance, identity monitoring for minor children and credit and fraud monitoring for three years. The Office of Personnel Management announced that it would send “notification packages” to affected employees, including “educational materials and guidance to help them secure their data.

However, officials acknowledged to Congress that the agency had failed for years to take necessary steps to secure its computer networks. The Office of Personnel Management was also condemned for not being fully candid with Congress and for silencing important information about the scale of the potential compromise. The officials claimed that instead of simply placing blame on the intruders, the OPM needs to acknowledge its own culpability in failing to adequately protect such an obvious target.

Apparently, the federal agencies have a long way to go safeguard their networks. Some of the critics even called for the OPM leadership to resign, as people have no more confidence that the current management at the OPM can take on the enormous task of repairing its national security. In particular, the Republicans called for the departure of OPM director Katherine Archuleta. In response, Katherine Archuleta announced that neither she nor OPM chief information officer Donna Seymour would resign.