Posted: 4:15 am  EDT
[twitter-follow screen_name=’Diplopundit’ ]

 

On May 28, just days before the OPM breach was reported, OPM issued a solicitation for OPM Privacy Act Incident Services. The services required include 1) notification services, 2) credit report access services, 3) credit monitoring services, 4) identity theft insurance and recovery services, and 5) project management services. According to the solicitation, these services will be offered, at the discretion of the Government, to individuals who may be at risk due to compromised Personally Identifiable Information (PII).  The $20,760,741.63 contract for Call 1 was awarded to Winvale Group, LLC (http://winvale.com) on June 2 but was published on fedbiz on June 5, the day after the breach was reported. Call 1 contract includes services to no more than 4 million units/employees.

Here’s what the company says via: http://winvale.com:

Excerpted from CSID FAQ:

What systems were affected?

For security reasons, OPM cannot publicly discuss specifics of the systems that might be affected by the compromise of personnel data. Additionally, due to the ongoing FBI investigation, it would be inappropriate to publicly provide information that may impact current work by law enforcement. OPM has added additional security controls to better protect overall networks and systems and the data they store and process.

What personal information was compromised?

OPM maintains personnel records for the Federal workforce. The kind of data that may have been compromised in this incident could include name, Social Security Number, date and place of birth, and current and former addresses. The communication to potentially affected individuals will state exactly what information may have been compromised.

Why didn’t OPM tell affected individuals about the loss of the data sooner?

OPM became aware of an intrusion in April 2015. OPM worked with the DHS’s Computer Emergency Readiness Team (US-CERT) as quickly as possible to assess the extent of the malicious activity and to identify the records of individuals who may have been compromised. During the investigation, OPM became aware of potentially compromised data in May 2015. With any such event, it takes time to conduct a thorough investigation, and identify the affected individuals.

It is important to note that this is an ongoing investigation that could reveal additional exposure; if that occurs, OPM will conduct additional notifications as necessary. Protecting the integrity of the information entrusted to the Office of Personnel Management is the agency’s highest priority.

I did not receive a letter stating that my information was compromised, but feel that I should have. Can you help me?

OPM is aware of the affected data and the networks and the data on which it resides. OPM will begin sending notifications to individuals whose PII may have been compromised on June 8, 2015. These notifications will take place on a rolling basis through June 19, 2015.

What are the risks of identity theft with the information that was compromised?

Receiving a letter does not mean that the recipient is a victim of identity theft. OPM is recommending that people review their letters and the recommendations provided. In order to mitigate the risk of fraud and identity theft, OPM will offer credit report access, credit monitoring and identify theft insurance and recovery services at no cost to them, through CSID®. This comprehensive, 18-month membership includes credit monitoring and $1 million in identity theft protection services.

How long will it take to inform all the potential victims involved in the incident?

OPM will begin conducting notifications to affected individuals using e-mail and/or USPS First Class mail on June 8, 2015 and will continue notifications on a rolling basis through June 19, 2015.

Can my [family member] also receive services if he/she is part of my file/records?

Your [family member] was not affected by this breach. The only data potentially exposed as a result of this incident is your personal data.

To see the full list of Frequently Asked Questions, click here. This is not dated, and it does not include any information on the potential breach of security clearance data.

If SF-86s are compromised, wouldn’t the breach potentially could also affect family members?

#