Five Times More Fingerprints Stolen in OPM Hack Than Previously Thought

The Office of Personnel Management says more fingerprint data was stolen in the massive breach of government employees files than first believed.

The number of federal personnel whose fingerprint data was stolen in the hack has increased from approximately 1.1 million people to 5.6 million, according to a statement Wednesday from OPM spokesman Samuel Schumach.

However, the latest revelation of exposed fingerprint data does not increase the overall number of people affected by the hack, which stands at about 21.5 million.

Along with fingerprint data, other purloined information includes Social Security numbers and sensitive data asked of federal employees and contractors applying for security clearances, such as financial history, drug use and sexual behavior.

OPM and the Defense Department made the discovery after “analyzing impacted data to verify its quality and completeness,” Schumach said.

It’s unclear how fingerprint data could be exploited by the hackers -- believed to be part of a Chinese espionage operation.

“Federal experts believe that, as of now, the ability to misuse fingerprint data is limited,” Schumach said in the OPM statement. “However, this probability could change over time as technology evolves. “

An interagency working group made up of the FBI, DOD, Homeland Security Department and members of the intelligence community “will review potential ways adversaries could misuse fingerprint data now and in the future,” as well as potential remedies, according to the statement.

“If, in the future, new means are developed to misuse the fingerprint data, the government will provide additional information to individuals whose fingerprints may have been stolen in this breach,” Schumach said.

An interagency team will continue to “analyze and refine the data” as the government prepares to mail notification letters to impacted employees and contractors.

The federal government inked an initial $133 million contract earlier this month -- five months after the breach was publicly disclosed --  to provide hack victims with three years of credit monitoring and identity-theft prevention services.

Working with the Defense Department, OPM will “begin mailing notifications to impacted individuals, and these notifications will proceed on a rolling basis,” Schumach said. Notifications are expected to begin later this month.

OPM has said any federal employee or contractor who has undergone a background investigation since 2000 is likely impacted by the breach.