OPM to Charge Agencies for Services Offered to Hack Victims

This story was updated with additional comment from OPM.

The Office of Personnel Management is asking agencies to pitch in to help pay for the credit monitoring services being offered to the 21.5 million individuals affected by the hack of background investigation data it maintains.

OPM and the Interior Department paid for the costs of the services offered to victims of the initial hack of 4.2 million former and current federal employees’ personnel files stored on a server housed at Interior. In a recent email to all agencies, however, acting OPM Direct Beth Cobert said this time around all agencies will have to contribute a yet-to-be determined amount from their fiscal 2015 appropriations.

Cobert said she had the full support of the Office of Management and Budget in making the request. An OMB spokesman declined to comment, referring inquiries to OPM.

Federal agencies will have to make the payments for the first year of the credit monitoring services and other benefits out of their fiscal 2015 appropriations. With the fiscal year set to end Sept. 30, the last-minute expense could prove disruptive to planned agency spending. Agencies will also be on the hook for credit monitoring costs for fiscal 2016 and fiscal 2017, as OPM has promised the “suite of services” to hack victims for three years.

Cobert said in an email to other agencies the cost for each federal entity is not yet known.

“OPM is currently working to approximate each agency’s portion of the total number of individuals impacted and we are gaining more information on the anticipated cost per person in the coming week based on requirements,” Cobert wrote. She added that OPM will send an estimate next week, but the final cost will not be known until the contract is awarded. She did not provide a timetable for completing that process.

An OPM spokesman said the costs will be proportional to the total number of individuals affected by the breaches at each agency, a strategy that was developed "in concert with" OMB. 

"OPM is committed to providing those affected by the recent cyber incident involving federal background investigations data with information and appropriate resources in a timely and effective manner," said Sam Schumach, the agency's press secretary. 

The contract related to the first hack cost OPM and Interior $21 million. That affected far fewer individuals and OPM promised just 18 months of credit monitoring services that were not as extensive as those for the second wave of victims.  

Cobert said in the email to other agencies, however, those costs “will be recovered via FY 2016 price adjustments.”

The former OMB official who took over as OPM chief when Katherine Archuleta resigned in the wake of the hacks said OPM will also have to raise the prices it charges agencies for conducting background investigations. After OPM terminated its contract with the company that had been primarily responsible for conducting background investigations, Cobert said its costs have gone up and the agency can no longer “sustain operations and financial stability” until it stabilizes its revenue. The price hike will be retroactive to the beginning of fiscal 2015.

Cobert acknowledged the increased investigations fees, coupled with the credit monitoring costs, will cause some problems at the affected agencies.

“We understand and appreciate the complexities of this late in FY15 request for funds,” Cobert wrote. “We cannot stress enough the importance and significance of this funding. This funding is critical to ensure that OPM is able to maintain its operational capability in order to allow agencies to continue to fill critical positions and accomplish their missions.”