Sex, Lies and debt White House employees potentially exposed to Hack

White House employee hacked? As I have a post on the post yesterday. That the White House revealed that hackers had broken a second computer system in the office of personnel management.
The disclosure that hackers had penetrated a database containing such intimate and possibly damaging facts about millions of government and private employees has shaken Washington. Officials said they believed that a separate computer system at the agency was breached by the same hackers, putting at risk not only data about the federal employees, but also information about friends, family members and associates that could number millions more. Officials said that the second system contained files related to intelligence officials working for the F.B.I., defense contractors and other government agencies.
The hackers appeared to have obtained personal data from more than four million current and former federal employees in one of the boldest invasions into a government network. 

The data breach is the third major foreign intrusion into an important federal computer system in the past year. In an earlier attack,   some of the president's unclassified emails were apparently obtained by intruders. 
Sam Schumach, a spokesman for the personnel office, said that the F.B.I.’s incident response team had concluded “with a high degree of confidence” that systems containing information related to background investigations of current, former and prospective federal employees were compromise. 
A senior government official, speaking on the condition of anonymity, said that investigators became aware of the second intrusion while assessing the damage from the first breach. 
The official said the information apparently taken in the second breach appeared not to be limited to federal employees. The database contains copies of what is known as Standard Form 86, a questionnaire filled out by applicants for national security positions. The 127-page form can include medical data, including information on treatment or hospitalization for “an emotional or mental health condition.”

The hacking of the White House Office of Personnel Management (OPM) could provide a treasure trove for foreign spies. The disclosure that OPM's data had been hacked sent shivers down the spines of current and former U.S. government officials as they realized their secrets about sex, drugs and money could be in the hands of a foreign government.
"The potential loss here is truly staggering and, by the way, these records are a legitimate foreign intelligence target," said retired Gen. Michael Hayden, a former CIA and NSA director.

A review of appeals of security denials published on the web shows the variety of information now in possession of the hackers, including financial troubles, infidelities, psychiatric diagnoses, substance abuse, health issues and arrests.
"It's kind of scary that somebody could know that much about us," said a former senior U.S. diplomat, pointing out the ability to use such data to impersonate an American official online, obtain passwords and plunder bank accounts.

President Obama was considering financial sanctions against the attackers who gained access to the files of millions of federal workers. Mr. Obama was weighing the use of an executive order he signed in April that allows the Treasury secretary to impose sanctions on individuals or groups that engage in malicious cyberattacks, or people who benefit from them. The personnel office has said that the number of federal employees and applicants affected could rise beyond the four million already reported. If the relatives and close contacts are included, the total number of people affected could be several times as high.
The order gives the administration the ability to freeze assets in the United States, bar Americans from doing business with groups that sponsor cyberattacks, and cut the groups off from American goods and technology.
Those steps include continuous, real-time monitoring of computer networks and the use of multifactor authentication, in which users are required to go beyond user names and passwords to verify their identity when logging on. Neither of those security features was in place at the personnel office before the attack last month.