After Breach, OPM Ignored Contracting Requirements in ID Monitoring Deal

Mar 7, 2018

The Office of Personnel Management is suffering recurring headaches from its devastating data  breaches. Not only do information security weaknesses persist at the personnel agency, OPM's inspector general found a series of improprieties with a contract awarded to perform credit monitoring and identity theft in the aftermath of the breach.

The OPM data breach consisted of two breaches -- one that exposed the personnel records of 4.2 million current and former federal employees, and another that exposed the background investigation records of 21.5 million current, former and prospective federal employees. Both events were made public in 2015. There was considerable -- but not complete -- overlap between victims of the two attacks.
 
In September 2015, OPM, along with the Department of Defense, awarded a contract to Identity Theft Guard Solutions, doing business as ID Experts, to provide free credit and identity monitoring, insurance and identity restoration services.

In a review of the ID Experts contract award that took place in October 2016, OPM's IG found a series of non-compliance issues during the award process, led by the agency's Office of Procurement Operations....