Attackers compromised the U.S. Office of Personnel Management in two linked intrusions, later designated X1 and X2. The first was discovered on March 20, 2014, after a third party notified the Department of Homeland Security about data exfiltration; the second began on May 7, 2014, when attackers impersonated an employee of contractor KeyPoint Government Solutions, but was not discovered until April 15, 2015. OPM announced the breach in June 2015, reporting that approximately 22.1 million records were affected, including Social Security numbers, names, birth dates, addresses, background-investigation files, and 5.6 million fingerprint sets. SF-86 questionnaires also contained information about relatives, foreign contacts, college roommates, and psychological history.
U.S. officials and congressional investigators attributed the operation to Chinese state-sponsored actors, widely believed to involve the Jiangsu State Security Department, although China denied responsibility and the motive was not definitively established. DHS official Andy Ozment testified that attackers likely obtained valid credentials through social engineering, installed malware and a backdoor, escalated privileges, and accessed broad OPM systems. A March 2015 inspector general report had already warned of persistent security deficiencies, including weak control testing and incomplete authorization records. Director Katherine Archuleta resigned on July 10, 2015, CIO Donna Seymour resigned in February 2016, and Chinese national Yu Pingan later pleaded guilty in the United States to conspiracy involving Sakula malware, receiving time served and a $1.1 million restitution order in February 2019. A 2018 review found 29 of 80 government recommendations still unresolved.
