One of the reasons for the 700,000 case backlog and 2-3 year wait for a new background is the Office of Personnel Management hack, which made headlines in 2015. It created millions of additional costs for OPM, which now has to cover identity theft protection for more than 20 million individuals. It also promoted the shut down of eQIP, the system used to track background investigation applications, for a full month. And in a process that was barely making the grade to begin with, it prompted a full-on crash.
This week the FBI made its first arrest in the hacking case, nabbing a Chinese national who flew into Los Angeles for a conference. (This further reiterates my belief that even the *smartest* criminal really isn’t that smart after all. How hard is it to stay away from Los Angeles if you’re a cyber criminal who is KNOWN for creating malware used to attack American businesses? I guess he just really needed the networking opportunities).
The OPM hack isn’t actually named in the FBI’s indictment against Yu Pingan. Rather, he faces charges under the Computer Fraud and Abuse Act and is accused of conspiracy to defraud the United States for his role in a site selling malware.
Among the malware up for sale on Yu’s site is Sakula, a Trojan which is believed to be behind the OPM hack, as well as other data breaches targeting U.S. companies.
While China has denied accusations they were behind the attack, it should come as no surprise the country, which runs one of the most robust cyber espionage games in the world, is after personal information about security clearance holders. They have successfully targeted and pillaged defense contractors for decades. The OPM hack put them in possession of the names, vulnerabilities and associations of more than 19 million government security workers. You can bet they’re using it.
