My understanding is that if you submitted an SF-86 form in the last 10 to 15 years, you were affected.
I believe Defense had their own, parallel system, so it may not be a given that you're in the leak.
Cleared employees are in the OPM data leak.
Not all of them. For example, the reported risk to CIA agents in US embassies in China was that they would suspiciously not be in the leaked data like actual State dept staff would be.