How feds can sign up for new OPM breach coverage

By

Carten Cordell

The U.S. Office of Personnel Management is photographed Tuesday, Sept. 6, 2016, in Washington. It was time to purge the hacker from the U.S. government’s computers. After secretly monitoring the hacker’s online movements for months, officials worried he was getting too close to critical information and devised a plan to expel him. Trouble was, with all their attention focused in that case, they missed the other hacker entirely. A new congressional report provides previously undisclosed details and a behind-the-scenes chronology of one of the worst-ever cyberattacks on the United States, laying out missed opportunities before the break-in at the OPM exposed security clearances, background checks and fingerprint records. (AP Photo/Jacquelyn Martin)

Federal employees impacted by last year’s cyber hack of the Office of Personnel Management have a month to re-enroll for credit and identity monitoring protections offered by the agency.


That’s because the contract of the original coverage provider, Winvale/CSID, is set to expire on Dec. 1 after 18 months of service.  

“We are asking individuals to re-enroll,” said a senior OPM official. “This is because of our concern about people and the privacy and security of their information. It’s an opportunity for individuals to confirm that the information that they would like to have monitored is current.”

Nearly 600,000 people who were affected in the 2015 personnel records breach will get the same identity monitoring protections, but only if they enroll with a new provider, ID Experts, by the end of the month.


The Winvale contract awarded in June 2015, in the immediate aftermath of the breach, but was later found to have been in violation of the Federal Acquisition Regulation and was slated to last 18 months. ID Experts will provide the same identity monitoring protections as part of the General Services Administration’s Identity Monitoring Data Breach Response and Protection Services blanket purchase agreement.

OPM said it will send notifications to those whose monitoring services about to end, but federal employees with questions about their coverage can take the following steps:

For employees impacted by both the personnel records and background investigations breach:

head to OPM’s webpagefor identity protection enrollment, you will need the 25-digit pin sent during the initial breach notification. If you lost the pin, the webpage also has a verification feature that will provide you a duplicate copy.

For employees impacted by the personnel records breach alone:

OPM will mail you a 25-digit pin to enroll for service. The agency said it expects the majority of the notifications to be mailed out during November. Employees must have the pin to enroll and cannot receive it over the phone.

OPM said that Winvale/CSID will complete any identity theft restoration services the company receives on or before Dec. 1, but continued monitoring will expire on that date.

The current contract with ID Experts will last until Dec. 31, 2018, after which OPM plans on extending the contract coverage and protections to fulfill the full 10-year commitment. Any federal employees that were covered by Winvale/CSID and ID Experts or only ID Experts will not have to take any additional action.

OPM said that ID Experts cannot tell federal employees whether they are impacted by the enrollment change or provide them with a pin. Pins must be requested through OPM’s Verification webpage.

For more information on OPM’s re-enrollment process, check out

the agency’s frequently asked questions page

.