Office of Personnel Management data breach (2015)

Date	The exact date of the breach into Office of Personnel Management servers is unknown. Nevertheless, malware had been residing in the servers since at least 2012 and the earliest known malicious activity so far disclosed dates back to November 2013. The gravest part of the attack – an exfiltration of background investigation and personal data – was carried out between June 2014 and March 2015. The attack was not completely blocked until 30 June 2015.
Suspected actor	Unknown state-sponsored group working for the Chinese government.
Target	United States Office of Personnel Management
Target systems	n/a
Method	It is not entirely clear how attackers gained access to OPM's networks. In the first phase, an attacker (A1) used a domain registered in the OPM server and exfiltrated IT system architecture and manuals. OPM found out about A1’s malicious activity and began to monitor it. Later, another separate attack was carried out by an attacker (A2) associated with A1 who posed as a background investigations contractor - KeyPoint - and, using an OPM credential, remotely accessed OPM’s network and installed PlugX malware to create a backdoor. On 27 May 2014 the OPM shut down its compromised systems in an effort to avoid more severe breaches by A1. While the OPM successfully expelled A1, A2, thanks to the backdoor, preserved its presence on the OPM network and later moved through the OPM environment to the U.S. Department of Interior data center where OPM personnel records were stored. The data exfiltration continued undiscovered until April 2015, when an OPM contractor working on IT security detected suspicious activity on the OPM network.
Purpose	Unclear. The attack was seen as an effort to gain valuable information about U.S. agencies and their employees as a part of an espionage campaign. The personal data of the U.S. employees could be also used for financial gain. Actually, some employees affected by the hack have claimed that they have been subjected to fraudulent credit charges, tax filings and other instances of identity theft that could credibly trace back to the OPM breaches.
Result	Sensitive information of 21.5 million individuals - applicants for security clearances and their relatives - was stolen from the background investigation databases, including approximately 5.6 million fingerprints. Moreover, OPM discovered that personnel data such as the name, birth date, home address and Social Security Numbers of 4.2 million current and former Federal government employees had been stolen.
Aftermath	OPM Director Katherine Archuleta as well as OPM chief information officer Donna Seymour resigned. Furthermore, two federal employee unions and several individuals sued OPM and KeyPoint for a violation of a constitutional right to informational privacy. The trial is still ongoing but so far the courts have found that this constitutional right had not been violated. Even though the Obama administration decided not to blame China for the massive breach in 2015, there was a strong belief that China was responsible for the attack. Chinese officials denied all the accusations, calling them irresponsible and unscientific. Later in 2017, President-elect Donald Trump said China was behind the massive breach. The same statement came also from John Bolton, White House National Security Adviser. Finally, it is worth noting that a Chinese national was arrested by FBI after being accused of conspiring with others to use Sakuta, a malware deployed in the OPM breach.
Analysed in	Scenario 02: Cyber espionage against government departments

Collected by: Adam Botek