NASA reveals data breach of employee information including Social Security numbers in October; scope of breach and number of impacted employees still unclear
Hack took place in October 2018. Agency still doesn't know the number of impacted employees. — The US National Aeronautics …
Context & Ripple Effects
This disclosure lands in a long line of federal personnel-data failures. The template was set in 2015, when the OPM breach exposed sensitive information on 21.5 million individuals and the federal employee union reported Social Security numbers on the entire federal workforce stolen — establishing that agency HR systems are a standing target.
What makes the NASA case notable is the disclosure lag and the missing headcount: the intrusion happened in October 2018 but was only revealed in December, with the agency still unable to say how many employees were hit. It also foreshadows a pattern at the agency itself — six months later NASA would disclose the unauthorized Raspberry Pi left on its network, where hackers had access for nearly a year.
First-order effects
- Affected NASA employees now face long-tail identity-theft exposure from stolen Social Security numbers, while the agency must run notifications without knowing the victim count — a disclosure made harder by the two-month gap between intrusion and announcement.
Second-order effects
- The unclear scope forces NASA to treat its entire workforce as potentially compromised, raising the cost of credit monitoring and remediation, and invites scrutiny of why detection took months — scrutiny that would intensify after the Raspberry Pi incident showed intrusions persisting for nearly a year on the same network.
Third-order effects
- Stacked against the OPM breach and the 2024 National Public Data leak of millions of SSNs, this is another data point in the erosion of the Social Security number as a usable identity credential — pushing agencies toward replacing SSN-centric records rather than repeatedly remediating their theft.
The trend: Federal agencies are proving chronically unable to detect and promptly disclose breaches of employee identity data, keeping SSN-based identity theft a structural liability across government HR systems.