Cybersecurity Policy Report, Bicameral Bill Would Extend Privacy Protections for OPM Data Breach Victims, (Aug 3, 2026)
Organizations Mentioned:Office of Personnel Management
Victims of the 2015 data breaches at the federal Office of Personnel Management (OPM) would receive identity theft monitoring and other data protection services for the rest of their lives under legislation introduced in the House and Senate.
Sen. Mark Warner (D., Va.) and Del. Eleanor Holmes Norton (D., D.C.) today announced the introduction of the Reducing the Effects of the Cyberattack on OPM Victims Enduring Response and Protecting Identifiable Information (RECOVER PII Act) Act.
The legislation would extend cyber protections for the 21.5 million federal employees, contractors, security clearance applicants, and members of Congress whose information was stolen in two OPM data breaches that were blamed on the Chinese government (CPR, June 8, 2015).
The 2015 breaches exposed a vast trove of personal data that included, among other things, information provided by security clearance applicants, fingerprints, Social Security numbers, and information about family members, overseas travel, and past addresses.
“Following this historic breach, Congress directed OPM—through the Consolidated Appropriations Act of 2017—to provide identity protection services to the federal employees, contractors, and Members of Congress whose personal data was compromised for not less than 10 years, the end of which will come in September 2026,” the lawmakers noted in a fact sheet.
“Now, a decade later and following many insidious cyber-attacks and intrusions by China and others, Congress should continue to protect the victims of the 2015 OPM data breaches. The ever-increasing amount of personal data in cyberspace has generated novel dangers to new and long-time federal workers, military members, their families, and federal government contractors who work to serve the American people,” they said.
“More than ten years after the OPM data breach exposed the personal information of millions of federal employees, the threat remains. The data stolen included workers’ most sensitive and personal information—from Social Security numbers to security clearance records—and once that information is in the hands of a bad actor, you don’t get it back,” Sen. Warner said in a news release.
“We have a responsibility to stand by the federal workers who were put at risk through no fault of their own. This legislation will ensure those affected continue to receive the identity protection they need, while helping better safeguard personal information from future exploitation,” he added.
“Lifetime identity protection is the only solution that will give the workers whose data was compromised the peace of mind they deserve," Del. Norton said. "Because there is no limit on how long personal information can be exploited, Congress must protect these federal employees and contractors in perpetuity.”
In the Senate, the legislation is co-sponsored by Sens. Tim Kaine (D., Va.), Angela Alsobrooks (D., Md.), and Chris Van Hollen (D., Md.). House co-sponsors include Reps. Don Beyer (D., Va.) and Steny Hoyer (D., Md.).
News: FederalLegislation DataPrivacy DataBreach DataSecurity