Office of Personnel Management data breach (2015)

Date 	The exact date of the breach into Office of Personnel Management servers is unknown. Nevertheless, malware had been residing in the servers since at least 2012 and the earliest known malicious activity so far disclosed dates back to November 2013. The gravest part of the attack – an exfiltration of background investigation and personal data – was carried out between June 2014 and March 2015. The attack was not completely blocked until 30 June 2015.“Report from the Committee on Oversight and Government Reform on the OPM Breach” (September 7, 2016), Committee on Oversight and Government Reform, U.S. House of Representatives.
Suspected actor	Unknown state-sponsored group working for the Chinese government.Josh Fruhlinger, “The OPM hack explained: Bad security practices meet China's Captain America” (November 6, 2018), CSO.Ian Smith, “Bolton Confirms China was Behind OPM Data Breaches” (September 21, 2018), FedSmith.com.
Target 	United States Office of Personnel Management
Target systems 	n/a
Method 	It is not entirely clear how attackers gained access to OPM's networks. In the first phase, an attacker (A1) used a domain registered in the OPM server and exfiltrated IT system architecture and manuals. OPM found out about A1’s malicious activity and began to monitor it. Later, another separate attack was carried out by an attacker (A2) associated with A1 who posed as a background investigations contractor - KeyPoint - and, using an OPM credential, remotely accessed OPM’s network and installed PlugX malware to create a backdoor. On 27 May 2014 the OPM shut down its compromised systems in an effort to avoid more severe breaches by A1. While the OPM successfully expelled A1, A2, thanks to the backdoor, preserved its presence on the OPM network and later moved through the OPM environment to the U.S. Department of Interior data center where OPM personnel records were stored. The data exfiltration continued undiscovered until April 2015, when an OPM contractor working on IT security detected suspicious activity on the OPM network.
Purpose 	Unclear. The attack was seen as an effort to gain valuable information about U.S. agencies and their employees as a part of an espionage campaign.Tom Risen, Staff Writer, “China Suspected in Theft of Federal Employee Records” (June 5, 2015), US News. The personal data of the U.S. employees could be also used for financial gain. Actually, some employees affected by the hack have claimed that they have been subjected to fraudulent credit charges, tax filings and other instances of identity theft that could credibly trace back to the OPM breaches.Eric Katz, “Federal Employees Suing OPM Score Win in Lawsuit Over Data Hacks” (June 24, 2019), Government Executive.
Result 	Sensitive information of 21.5 million individuals - applicants for security clearances and their relatives - was stolen from the background investigation databases, including approximately 5.6 million fingerprints. Moreover, OPM discovered that personnel data such as the name, birth date, home address and Social Security Numbers of 4.2 million current and former Federal government employees had been stolen.“CYBERSECURITY INCIDENTS“, Office of Personnel Management.
Aftermath 	OPM Director Katherine Archuleta as well as OPM chief information officer Donna Seymour resigned.“Report from the Committee on Oversight and Government Reform on the OPM Breach” (September 7, 2016), Committee on Oversight and Government Reform, U.S. House of Representatives. Furthermore, two federal employee unions and several individuals sued OPM and KeyPoint for a violation of a constitutional right to informational privacy. The trial is still ongoing but so far the courts have found that this constitutional right had not been violated.Amelia Brust, David Thornton, “Appeals court rules OPM data breach left people vulnerable to harm” (June 27, 2019), Federal News Network.
Even though the Obama administration decided not to blame China for the massive breach in 2015,Ellen Nakashima, “U.S. decides against publicly blaming China for data hack” (July 21, 2015), The Washington Post. there was a strong belief that China was responsible for the attack. Chinese officials denied all the accusations, calling them irresponsible and unscientific.Dominic Rushe, “OPM hack: China blamed for massive breach of US government data” (June 5, 2015), The Guardian. Later in 2017, President-elect Donald Trump said China was behind the massive breach.Michael D. Shear, David E. Sanger, “Putin Led a Complex Cyberattack Scheme to Aid Trump, Report Finds” (January 6, 2017), The New York Times The same statement came also from John Bolton, White House National Security Adviser.Ian Smith, “Bolton Confirms China was Behind OPM Data Breaches” (September 21, 2018), FedSmith.com. Finally, it is worth noting that a Chinese national was arrested by FBI after being accused of conspiring with others to use Sakuta, a malware deployed in the OPM breach. Joseph Menn, “Chinese national arrested in Los Angeles on U.S. hacking charge” (August 25, 2017), Reuters.
Analysed in 	Scenario 02: Cyber espionage against government departments
Collected by: Adam Botek
Category:Example
Category:2015