MASSIVE OPM HACK EVEN WORSE THAN THOUGHT: OPM Hack Far Deeper Than Publicly Acknowledged, Went Undetected For More Than A Year, Sources Say.

The massive hack into federal systems announced last week was far deeper and potentially more problematic than publicly acknowledged, with hackers believed to be from China moving through government databases undetected for more than a year, sources briefed on the matter told ABC News.

“If [only] they knew the full extent of it,” one U.S. official said about those affected by the intrusion into the Office of Personnel Management’s information systems.

It all started with an initial intrusion into OPM’s systems more than a year ago, and after gaining that initial access the hackers were able to work their way through four different “segments” of OPM’s systems, according to sources.

Much of that data has been stored on OPM systems housed by the Department of the Interior in a Denver-area data center, sources said. And one of the four “segments” compromised held forms filled out by federal employees seeking security clearances.

As ABC News previously reported, the 127-page forms — known as SF-86’s and used for background investigations — ask applicants for personal information not only about themselves but also relatives, friends, and potentially even college roommates.

But wait, it gets worse: Report: Hack of government employee records discovered by product demo: Security tools vendor found breach, active over a year, at OPM during sales pitch.

According to a Wall Street Journal report, the breach was indeed discovered in April. But according to sources who spoke to the WSJ’s Damian Paletta and Siobhan Hughes, it was in fact discovered during a sales demonstration of a network forensics software package called CyFIR by its developer, CyTech Services. “CyTech, trying to show OPM how its cybersecurity product worked, ran a diagnostics study on OPM’s network and discovered malware was embedded on the network,” Paletta and Hughes reported.
Further Reading
Why the “biggest government hack ever” got past the feds

Inertia, a lack of internal expertise, and a decade of neglect at OPM led to breach.

And, according to federal investigators, that malware may have been in place for over a year. US intelligence agencies have joined the investigation into the breach. But it’s still not even clear what data was accessed by the attackers.

Meanwhile, the breach has triggered outrage from unions representing federal employees.

This allows a foreign nation to go to war with federal employees on a personal basis.