More than a quarter of the victims in a cyberattack on the federal government — which lost data belonging to 21 million people — also had their fingerprints stolen, a federal agency said Wednesday.
The agency, a sort of human resources department for the federal government known as the Office of Personnel Management, initially said just 1.1 million sets of fingerprints had been stolen in the hack. A statement released Wednesday said the agency was revising that number to 5.6 million.
The people in the hacked database included current and former federal employees, as well as people who had applied for background checks and their relatives.
While "federal experts believe that, as of now, the ability to misuse fingerprint data is limited," the agency said, "this probability could change over time as technology evolves."
OPM said a joint task force — including the Federal Bureau of Investigation, Department of Homeland Security and Defense Department — will now "review the potential ways adversaries could misuse fingerprint data now and in the future."
"If, in the future, new means are developed to misuse the fingerprint data, the government will provide additional information to individuals whose fingerprints may have been stolen in this breach," OPM said.
Besides fingerprints, a trove of other confidential information was taken in the hack, which was first discovered in May. The stolen information includes Social Security numbers; findings from background check interviews; information about past addresses, education and jobs; criminal and financial histories; and "some information regarding mental health."
Many reports have linked the attack to Chinese hackers. The fallout cost OPM Director Katherine Archuleta her job. She resigned just a day after the agency revised its initial estimate of total victims from 4.2 million federal employees to more than 19.7 million people who had applied for background checks and 1.8 million related "non-applicants," including applicants' spouses, roommates and family members.
OPM has already begun offering free credit and identity theft monitoring services to people affected by the hack.