The OPM breach took place in June or July 2014, giving hackers a year to sift through data
Ellen Nakashima / Washington Post :
Context & Ripple Effects
By mid-June 2015, the OPM story had already escalated twice: what looked like a contained theft was exposed during a security vendor's sales demo as far worse than first believed, and Reuters tied the intrusion to a rare tool also used in the Anthem breach. The Daily Beast then reported hackers pulled potentially humiliating adjudication detail on federal workers.
This report pins the intrusion's start to June or July 2014 — meaning roughly a year of undetected access before discovery, which explains why each disclosure kept expanding. Weeks later OPM confirmed a separate hack touching 21.5 million individuals, and the same agency reappeared on breach lists in 2023 when MOVEit compromised ~632K DOD and DOJ employee emails.
First-order effects
- Federal employees whose records sat in OPM systems faced up to a year of adversary access before detection — the scope of exposure is set by this timeline, not by when the public learned of it.
- OPM was pushed straight into remediation mode, including shutting down the federal background check system for four to six weeks to patch a vulnerability after the hack.
Second-order effects
- Shared tooling with the Anthem breach sharpened attribution pressure toward Chinese intelligence-linked actors, raising the diplomatic stakes beyond a routine data-theft case.
- Stolen adjudication information — infidelity, drug use, debt — becomes leverage for targeting cleared personnel, turning every affected worker into a potential counterintelligence risk rather than just an identity-theft victim.
Third-order effects
- Consolidating security-clearance and personnel files in one agency created a single high-value target whose compromise cascades across government — a blast-radius problem that resurfaced when OPM email accounts were hit again via MOVEit in 2023.
- Long-dwell intrusions discovered by third parties rather than internal monitoring became the template for arguing that federal agencies need outside validation of their defenses.
The trend: Government personnel-data repositories keep proving to be strategic targets, with multi-year dwell times and repeat hits showing the underlying concentration of sensitive records has not been fixed.