Hacker News Reader

Comment by forrestbrazeal | Hacker News Reader

One of the most frustrating things about this whole fiasco is that the OPM breach finally became public in the summer of 2015, but I and many other victims weren't officially notified (or offered our measly couple years of identity protection) until December or later. At the time, I shared some of my thoughts on the breach here (some of the info may be out of date in light of the new report; I was piecing stuff together as best as I could): https://forrestbrazeal.com/2015/12/08/welp-i-was-an-opm-hack...

I was also annoyed that so much of the political posturing around the breach centered on OPM systems' lack of encryption. I haven't read all of this report, but it's nice to see the summary focusing on the lack of 2FA, a security practice that would actually have helped stop an internal infiltrator.

View on HN

I just got my postcard informing me I was affected last month. I tossed the offer of credit protection because I'm already stacking multiple "we're sorry" credit protections from other breaches.

The thing that burns me though, is that the credit protection is for a limited time. The severity of this breach and they can't give us a lifetime of protection?!?

What is "credit protection"?

In the US, most things are based on credit and not on actual money you have. If your credit is bad you can't do basic things like get a car, a house or a loan. If your identity is stolen someone else can do things in your name, and for example not pay back a loan. This causes your credit rating to sink, on top of the other problems (like people coming to your house because you didn't pay them).

If you check out http://money.visualcapitalist.com/all-of-the-worlds-money-an... you can see the derivatives and debt are a huge chunk of the not-actual-money part of the economy, which one way or the other is based on credit, credit ratings or ratings in general.

While this probably doesn't scale back to 1 person's identity, it does show that having someone mess with your credit is a whole lot worse than someone just stealing some money.

I get that credit scores are important. They are also in Germany. But what does credit protection do? Pay all the debts? Fix my score with all rating agencies?

It monitors your credit score for unusual lending to stop fraud. Normally, they also include insurance to cover any fraudulent activity associated with your identity.

They will email you if you have a new inquiry or new account on your credit report(s). They will help you remove incorrect information and sometimes provide some financial assistance getting your documents replaced. Other than that they don't do much. They can't prevent someone from opening an account (only a credit freeze does that) and they can't tell you about non-credit identity theft.

You should take it. The opm breach offers the best credit and identity theft monitoring you can get. You can actually input your emails and other information and they will notify you when it's found in online dumps, etc. They also tell you the source of the dump.

I still never received any notice about it. Was employed by DoD in late 00's, so am fairly certain my info was in the batch.

I believe Defense had their own, parallel system, so it may not be a given that you're in the leak.

Cleared employees are in the OPM data leak.

Not all of them. For example, the reported risk to CIA agents in US embassies in China was that they would suspiciously not be in the leaked data like actual State dept staff would be.

Apparently the Defense investigators (DSS) merged into OPM in 2004- https://en.wikipedia.org/wiki/Defense_Security_Service

My understanding is that if you submitted an SF-86 form in the last 10 to 15 years, you were affected.

You'd remember filling out an SF-86. But yes, I was definitely in the breach, yet I have not been notified.

as a foreign citizen, previously living and working for the DoT through a contractor, i was never notified as well. pretty sure my data got leaked as well.

Reply on news.ycombinator.com