U.S. data hack might be four times larger than official government estimates

The personal data of an estimated 18m current, former and prospective federal employees were affected by a cyber breach at the U.S. Office of Personnel Management (OPM) – more than four times the 4.2m the agency has publicly acknowledged, CNN has reported in Washington.
The number is expected to grow, U.S. officials briefed on the investigation told the CNN on 24 June.
FBI director James Comey gave the 18m estimate in a closed-door briefing to senators in recent weeks, using the OPM’s own internal data, CNN reports. Those affected could include people who applied for government jobs, but never actually ended up working for the government.
The same hackers who accessed OPM’s data are believed to have last year breached an OPM contractor, KeyPoint Government Solutions, U.S. officials said. When the OPM breach was discovered in April, investigators found that KeyPoint security credentials were used to breach the OPM system.
OPM has so far stuck by the 4.2m estimate, which is the number of people so far notified that their information was compromised. An agency spokesman said the investigation is ongoing and that it hasn’t verified the larger number.
The actual number of people affected is expected to grow, in part because hackers accessed a database storing government forms used for security clearances, known as SF86 questionnaires, which contain the private information of multiple family members and associates for each government official affected, these officials said.
OPM officials are facing multiple congressional hearings this week on the hack and their response to it.