# OPM Data Breach (2014-2015)
The Office of Personnel Management breach is not merely a large data breach. It is, by the assessment of multiple U.S. intelligence officials, one of the most damaging espionage operations conducted against the United States government in the modern era. What makes it extraordinary is not the volume of records exfiltrated, though 21.5 million individuals is a large number, but the nature of what those records contain.
The Standard Form 86 (SF-86), formally titled "Questionnaire for National Security Positions," is the document every person applying for a U.S. government security clearance must complete. It is among the most comprehensive personal disclosures any government requires of its citizens. An adversary holding SF-86 data on millions of clearance applicants does not merely possess a data breach. They possess a structured intelligence database: a map of who the U.S. national security apparatus trusts, what leverage points exist against those individuals, and how to identify officers operating under cover.
The breach unfolded across two related but distinct incidents. The first, disclosed in June 2015, involved OPM's personnel records: 4.2 million current and former federal employee HR files including personnel evaluations, job assignments, and training records. The second, disclosed in July 2015 and far more consequential, involved the SF-86 background investigation records database: 21.5 million individuals who had applied for security clearances going back to 1985, plus their family members, cohabitants, and references, who had not applied for clearances themselves but whose information was included in the background investigation questionnaires.
Attribution with high confidence points to Chinese state-sponsored actors. U.S. intelligence officials have publicly assessed the breach as the work of APT10, also known as Deep Panda or Stone Panda, a threat group assessed to operate on behalf of China's Ministry of State Security. China has never formally acknowledged responsibility.
Phase 1: Initial Access
The precise initial access vector for the OPM breach has not been officially confirmed in public reporting. The most credible accounts link the initial compromise to KeyPoint Government Solutions, a major federal contractor that processed security clearance background investigations for OPM. KeyPoint was itself breached in 2014, and the theft of contractor credentials is the most widely reported initial access hypothesis. Contractors processing background investigations had legitimate authenticated access to OPM systems, making credential theft a high-value target.
The attackers may have also used other vectors, including spear phishing campaigns targeting OPM employees directly. In either case, the result was valid credentials for OPM systems being in the hands of attackers who had no legitimate claim to them.
Phase 2: Persistence and Reconnaissance
After gaining initial access, the attackers established persistent footholds within OPM's network using malware and backdoors. Multiple malware families were subsequently identified on OPM systems during the forensic investigation, including PlugX, a remote access trojan commonly associated with Chinese state-sponsored threat actors.
The attackers maintained access for an extended period, likely beginning in late 2014 and continuing through May 2015 when OPM's own investigation discovered the intrusion. During this time, they engaged in systematic reconnaissance: mapping the network, identifying database systems, understanding how data was organized and accessed, and staging data for exfiltration. The dwell time across the full breach window is estimated at well over a year.
Phase 3: Data Exfiltration
The attackers exfiltrated data from two primary databases. The personnel records database contained HR information on current and former federal employees. The background investigation database, referred to internally as the Central Verification System and related systems, contained the SF-86 records.
A particularly damaging detail: the SF-86 database was not encrypted at rest. OPM's IT systems were, by multiple government auditor assessments, among the most outdated and poorly maintained in the federal government. Annual reports from OPM's Inspector General had flagged inadequate security controls for years before the breach, including the absence of encryption for sensitive data at rest.
The exfiltration occurred over an extended period and was not detected in real time. The breach was ultimately discovered not by OPM's own monitoring but through analysis of DHS's Einstein network intrusion detection system, which identified anomalous outbound traffic from OPM networks.
Root Cause 1: Outdated and unsupported IT systems. OPM's IT infrastructure at the time of the breach included legacy systems running on outdated operating systems with limited capacity for modern security controls. The Inspector General had repeatedly flagged these systems as high risk. Legacy infrastructure is not just a performance problem; it is a security problem because it often cannot support encryption, EDR agents, or modern authentication protocols.
Root Cause 2: Absence of encryption for the SF-86 database. The most sensitive database the U.S. government operates outside the intelligence community was stored unencrypted. Encryption at rest does not prevent a sophisticated attacker who compromises a database administrator's credentials from reading the data, but it raises the bar significantly. Attackers must remain on-system with active decryption capability rather than being able to exfiltrate an encrypted blob and work offline. More importantly, encryption of specific high-value datasets triggers the kind of key management and access logging disciplines that can surface unauthorized access earlier.
Root Cause 3: Inadequate access controls and no MFA for contractor access. KeyPoint and other OPM contractors had authenticated access to OPM systems based on username and password credentials. Given that OPM's systems contained the most sensitive personnel records in the federal government, access should have required multi-factor authentication for all users including contractors. The contractor access model gave external parties access to production systems without the additional authentication friction that would have made stolen credentials insufficient on their own.
Root Cause 4: Extended dwell time without detection. The attackers operated inside OPM's network for over a year. Modern threat detection capabilities, including user and entity behavior analytics (UEBA), network traffic analysis, and endpoint detection and response (EDR), are designed specifically to surface the kind of systematic reconnaissance and staged exfiltration behavior that characterized this attack. OPM's detection capabilities were insufficient to surface this activity from within. External detection via Einstein, a perimeter-level system, was what ultimately identified the breach.
Root Cause 5: Governance failures identified and unaddressed. The OPM Inspector General published annual Federal Information Security Management Act (FISMA) audit reports in the years before the breach that identified many of the same control gaps exploited by the attackers: inadequate access controls, unpatched systems, missing encryption, and incomplete network monitoring. These findings were documented, reported, and not remediated. The governance failure is not that the gaps were unknown but that the known gaps were not treated with urgency proportional to the sensitivity of the data at risk.
The immediate operational impact on U.S. national security is difficult to overstate. Retired CIA Director John Brennan described the SF-86 data as "invaluable" from an intelligence perspective. Former NSA and CIA Director Michael Hayden said the breach represented a "tremendous tactical victory" for China.
The specific harms include: identification of CIA and other intelligence officers operating under cover (their SF-86s would list their real employer even if their public cover did not), the creation of a targeting list for recruitment and coercion of individuals with security clearances, the identification of vulnerabilities (financial, personal, health-related) that could be used for blackmail, and the comprehensive mapping of family members, cohabitants, and personal references who could themselves be approached or leveraged.
More than 21.5 million individuals received formal breach notifications. OPM contracted with ID Experts to provide identity theft monitoring and protection services. The estimated cost of remediation, notification, and IT modernization exceeded $500 million. The Office of Personnel Management underwent a significant restructuring of its IT security organization and accelerated a years-delayed IT modernization program.
Several federal CISO and CIO positions were restructured following the breach. Congress passed legislation creating the position of Federal Chief Information Security Officer within the Office of Management and Budget and increased oversight requirements for federal agency cybersecurity programs.
The OPM breach illustrates failures across all four of its mapped PDM domains, and the interaction between them is what made the breach as consequential as it was.
DPS (Data Protection and Sovereignty): The SF-86 database should have been encrypted at rest as a baseline control, regardless of other security measures. The Sovereign Data Protocol (SDP) starts from the question: "What is the absolute minimum access that any system or actor needs to read this data, and how do we enforce that boundary?" An unencrypted database of 21.5 million security clearance records is a single-point-of-failure for one of the most sensitive datasets in the federal government. SDP requires encryption at rest, tokenization of high-value fields, and access logging at the data layer, not just the application or network layer. None of these controls were present.
IAT (Identity Access and Trust): Contractor credentials functioned as full keys to OPM's most sensitive systems. Zero Possession Architecture (ZPA) treats every access grant as potentially compromised and asks what the consequence of that compromise is. If contractor credentials give access to the SF-86 database, then the security of the SF-86 database is as good as the security of every contractor's endpoint and credential store. ZPA requires MFA, session limits, least-privilege scoping, and just-in-time access grants for contractor relationships touching sensitive data. None of these controls were in place at the required level.
TID (Threat Intelligence and Defense): The attackers dwelt inside OPM's network for over a year. Predictive Defense Intelligence (PDI) operates on the premise that prevention will fail and that the ability to detect and contain an intrusion quickly is what limits damage. A dwell time measured in months, with exfiltration occurring over an extended period and detection coming from an external network monitoring system rather than internal detection capability, represents a fundamental TID failure. A mature PDI program would have established behavioral baselines for database access patterns, flagged the volume and type of data being staged and exfiltrated, and surfaced the anomaly far earlier in the attack timeline.
RGA (Risk Governance and Assurance): The OPM Inspector General flagged the same security control gaps that enabled this breach in audit reports published years before the breach occurred. Perpetual Compliance Assurance (PCA) is not a compliance checkbox exercise: it is a continuous program that treats audit findings as risk events requiring risk-based remediation timelines, not footnotes in an annual report. When an Inspector General identifies that a database holding 21.5 million security clearance records lacks encryption and adequate access controls, that finding requires an immediate remediation plan with executive accountability, not a management response noting the finding has been acknowledged.
The sensitivity of data must drive security investment proportionally. OPM held some of the most sensitive personnel records in the federal government and operated some of the most underfunded and outdated IT infrastructure. The mismatch between data sensitivity and security investment is itself a governance failure that boards and agency heads must own.
Encryption at rest is a baseline, not an advanced control. Storing any large volume of sensitive personal data without encryption at rest is an indefensible architecture choice. This is especially true for federal agencies under FISMA obligations to implement NIST SP 800-53 controls, which include encryption of data at rest for high-impact systems.
Contractor access is your attack surface. Every third-party with authenticated access to your systems is a potential entry point. Contractor access must be governed with the same rigor as employee access, including MFA, least-privilege scoping, session monitoring, and regular access reviews.
Audit findings are not compliance artifacts. They are risk signals. When an Inspector General or internal audit function identifies a material control gap, the organizational response must be commensurate with the risk. Filing a management response and continuing to operate with the gap is not risk management; it is risk acceptance without documentation.
Dwell time is the metric that matters for nation-state threats. Nation-state adversaries are patient. They will accept slow, methodical exfiltration over months if it avoids detection. The only way to limit the damage from a sophisticated persistent intrusion is to reduce dwell time through continuous behavioral monitoring. Detection at the perimeter, after the attacker has already established internal persistence, is not sufficient.