OPM Spends $133 Million on Credit Monitoring, Still No Credit Freeze

September 4, 2015 By in Contractors, Federal Agencies, Huh? News, Security, Spectacular, State Department, Technology and Work Tags: , , , , 2 Comments

Posted: 12:34 am PDT
[twitter-follow screen_name=’Diplopundit’ ]

 

On September 1, OPM announced the $133M contract for identity thief protection and credit monitoring services for the 21.5 million individuals affected by the massive OPM breach that includes security clearance data. Our go-to expert on this says that “perhaps the agency should be offering the option to pay for the cost that victims may incur in “freezing” their credit files, a much more effective way of preventing identity theft.” Excerpt from Krebs on Security:

The only step that will reliably block identity thieves from accessing your credit file — and therefore applying for new loans, credit cards and otherwise ruining your good name — is freezing your credit file with the major credit bureaus. This freeze process — described in detail in the primer, How I Learned to Stop Worrying and Embrace the Security Freeze — can be done online or over the phone. Each bureau will give the consumer a unique personal identification number (PIN) that the consumer will need to provide in the event that he needs to apply for new credit in the future.

Here is part of the OPM announcement:

The U.S. Office of Personnel Management (OPM) and the U.S. Department of Defense (DoD) today announced the award of a $133,263,550 contract to Identity Theft Guard Solutions LLC, doing business as ID Experts, for identity theft protection services for 21.5 million individuals whose personal information was stolen in one of the largest cybercrimes ever carried out against the United States Government. These services will be provided at no cost to the victims whose sensitive information, including Social Security numbers, were compromised in the cyber incident involving background investigations.

“We remain fully committed to assisting the victims of these serious cybercrimes and to taking every step possible to prevent the theft of sensitive data in the future,” said Beth Cobert, Acting Director of the Office of Personnel Management. “Millions of individuals, through no fault of their own, had their personal information stolen and we’re committed to standing by them, supporting them, and protecting them against further victimization. And as someone whose own information was stolen, I completely understand the concern and frustration people are feeling.”

ID Experts will provide all impacted individuals and their dependent minor children (under the age of 18 as of July 1, 2015) with credit monitoring, identity monitoring, identity theft insurance, and identity restoration services for a period of three years. This task order was awarded under GSA’s Blanket Purchase Agreements (BPA) for Identity Monitoring, Data Breach Response and Protection Services which GSA awarded today.

The U.S. Government, through the Department of Defense, will notify those impacted beginning later this month and continue over the next several weeks. Notifications will be sent directly to impacted individuals.

 .

.

.

.

.

Heard that? Crickets.

#

2 responses

  1. OPM could pay for a credit freeze for everyone affected by the hack for less than the cost of the current contract. The real problem, however, is that identity theft is most likely not the primary object of the hackers, except as an adjunct to other intelligence operations. As a number of journalists and experts in the field have noted, Identity alteration or substitution within the current personnel system, the establishment of an undetectable and continuous hacker presence, and of course evaluation of USG personnel for possible compromise are all logical uses for the mountain of data the hackers have obtained. The current OPM system is so thoroughly compromised that it would probably be better to abolish it and start from scratch. I doubt, however, that the USG will take this step, because it would be an admission of just how monumental the security failure has been.