Slashdot Mirror
More Than 22 Million People's Data Compromised By OPM Hack
OutOnARock writes with news that the Office of Personnel Management data breach reported earlier this month was actually far worse than earlier estimates had it; in all, it seems that more than 22 million people (not all of them government employees) had personal information compromised by the breach. From Yahoo News's coverage: That number is more than five times larger than what the Office of Personnel Management announced a month ago when first acknowledging a major breach had occurred. At the time, OPM only disclosed that the personnel records of 4.2 million current and former federal employees had been compromised.
Peasants you know what to do!
My two-hour background investigation interview lasted four hours because the bureaucrats in Washington couldn't understand how one person can have multiple jobs. After being out of work for two years (2009-2010), underemployed for six months (working 20 hours per month) and filing for Chapter Seven bankruptcy in 2011, don't you think a person would work a regular Monday-Friday job and a weekend job to get his finances in better shape? Meh...
Enjoy my case file, hackers! I hope your head explodes from my employment misery!
for everyone to read
I believe that brings the total number of people compromised in the past few years up to about, oh, a hundred million.
Only the Civ Gov side.
So, only one of the five spy agencies you know about.
-- Tigger warning: This post may contain tiggers! --
22 million government workers get hacked probably because some anus site got SQL injected.
The NSA spends no time auditing it's own systems to protect American citizens, and All of it's time spying on Americans and "terrorists"
If the NSA's mission is to truely defend America, how come sensitive government systems are still prone to SQL injection?
Let this all sink in.
This database should contain all the personal details on spies. If this was stolen by China, why haven't we heard about every spy being pulled out of China and Russia? They are friend-enemies after all.
Any chance this hack done by the NSA to help get more funding and show the Americans how much they are needed to keep us safe? The NSA would know all the details of how the OPM works. Easy target.
Go into a big Chinese bank. What do you see? Most of the computers used for operations are still running XP. Hacking old Win 2003 servers in China from the US might not be very difficult. There are A LOT of Win 2003 servers in China. If you use these computers to launch an attack, who isn't going to believe those uber-smart Chinese have hacked us again?
If the Chinese actually have this data, there should be a huge reaction. I haven't see it. 1,000's to 10,000's of Americans at the embassies and working abroad should have run back to the US on very short notice. We should be hearing how our spying has been set back 20 years. Things are WAY too quiet It doesn't make sense to me.
Money? Forget money.
This is about the Chinese using blackmail against government employees with security clearances. They're on a war-footing.
If only there were some person responsible for making sure the USA were protected against these sorts of threats.
The US gov seemed to have really understood all the issues the UK and other nations had with selecting and sorting cleared staff from the UK security issues of the 1930's to 1980's.
Full background interviews, real cleared US gov staff looking deep into a persons submitted life story and the looking at the facts on the ground anywhere in the US.
Life story, education, friends, mail, reading material, calls logs all allowed the US gov to select the more useful and smart people for sensitive positions.
Over the past decade the move was to finding staff with unique skills quickly and trying to ensure US security paperwork was not going to be any issue for contractors, ex staff, former staff, people moving from the private sector into gov or gov into the private sector. All while keeping or re using past security access.
The US gov and mil could ensure skilled staff from the public and private sector where ready, could be found and sorted regionally and quickly for any task in or out of the USA.
The problem for the US gov is it needed so many contractors quickly and hoped remote digital files could 'clear' a boss and their new company or past contractor/mil/gov staff for new gov/mil/contractor work.
Vast new online digital databases allowed for lucrative jobs to be handed out and any security issues to fixed quickly.
The down side of this rapid system what what is what was fully understood by the US, UK, Australian and many other nations since the 1950's from their WW2 and 1930's security issues. Dont hire or create security in haste and keep the files away from all other people in gov, mil, private sector and other nations. How or why the US gov ever let go if its most secure files for national remote access is a real mystery.
Other nations who kept their files safe from new contractors needs and within the gov seemed to have understood the issues of rapid security expansion expansion and all the remote database issues. Why did the US gov and mil think it was a good idea or safe to allow complex files of that nature to just move regional and national networks from the mid 1990's on?
Domestic spying is now "Benign Information Gathering"
Love won, and bigots lost. Cry some more, bigot.
That will happen. It is only a matter of time.
So the NSA is clearly useless, and making the situation worse. They are not, and cannot protect us electronically. Instead, they are collecting all of our information and storing it for the inevitable hack that will give it to the rest of the world. The first question I ask when I'm asked to secure data is: "Do we actually need this data?" You can't steel what doesn't exist. Why the hell did this agency have data on people going back to the 1980s? Why is the NSA collecting data on all of us? It's a pointless endeavor that's putting us all at risk.
You don't need to be in love to get married. There's no requirement to prove love. Long term cohabitiating couples, homo or hetero don't need government validation of their relationships.
This is about recognition for benefits and property rights, though the latter was often done by homosexual couples through LLCs for joint property.
Bring back the old version of slashdot.
OPM is pretty legendary in federal circles as basically the sort of federal agency that inspired the bureaucrat jokes on Futurama. The only way to "reform" them is to just scuttle the agency and transfer its functions to the various departments. The Office of the Director of National Intelligence should get the investigators and that authority. Civil service management should be a per-department issue. Managing retirees' benefits could easily just be contracted out to whatever private companies already manage the asset pool of the pension funds. The federal retirees I know would love to deal with a bank rather than OPM. Why? A bank would actually give a shit about processing their communications in a timely fashion.
That will happen. It is only a matter of time.
Haven't you been paying attention? They already hacked blue cross, which is a shitload more concerning in terms of intelligence targets than hacking health care info for America's poor and out-of-work.
Until about a year ago, I had a security clearance. So I'm one of the 22 million. I've already been contacted by our site clearance officer. They gave me this link from the OPM about the breach, which has more information than the links in the article.
For those who haven't gone through it, during a background search they send actual human beings around to your friend and family, and then to second-order contacts they know who know you, to ask questions about you. So the OPM, and now the hackers, literally know stuff about me that I don't know.
Most government agencies would never have let this happen in the first place because they're not stupid enough to "save money" by creating such an unbelievably high value collection of data so easily accessible to the Internet. Another thing, they would never have hired foreign contractors to work on such a critical database. OPM's contract office should be headed to Leavenworth for that decision.
People are sheep.
Bring back the old version of slashdot.
Could someone just publish a list of everyone's name, phone numbers, addresses, and SSN's already? Then there would be some motivation for people and organizations to learn the difference between identification and authentication. Knowing a number with nine or so digits associated with an individual shouldn't give you access to their credit, whether it's their SSN or their telephone number.
Answer: Yes.
It was a phishing exploit that captured credentials of a valid user. It wasn't a technical compromise. It was social engineering facilitated by technology.
You can't protect that with better code.
Learning HOW to think is more important than learning WHAT to think.