Warner, Norton, Colleagues Introduce Bill to Give Lifetime Protections to Federal Workers Whose Information Was Stolen in Cyberattacks

WASHINGTON – U.S. Sen. Mark R. Warner (D-VA), Vice Chair of the Senate Select Committee on Intelligence, and Congresswoman Eleanor Holmes Norton (D-DC) introduced the Reducing the Effects of the Cyberattack on OPM Victims Enduring Response and Protecting Identifiable Information Act ( RECOVER PII Act ), bicameral legislation to provide lifetime identity protection coverage to federal employees whose personal information was compromised in the 2015 Office of Personnel Management (OPM) cyberattacks. More than a decade later, much of the stolen data has never publicly resurfaced, raising ongoing national security concerns that foreign adversaries may be retaining sensitive information for future intelligence or cyber operations. This legislation would also reimburse affected federal employees and contractors for privacy software and other eligible tools used to reduce their personal information online. “More than ten years after the OPM data breach exposed the personal information of millions of federal employees, the threat remains. The data stolen included workers’ most sensitive and personal information – from Social Security numbers to security clearance records – and once that information is in the hands of a bad actor, you don’t get it back,” said Sen. Warner. “We have a responsibility to stand by the federal workers who were put at risk through no fault of their own. This legislation will ensure those affected continue to receive the identity protection they need, while helping better safeguard personal information from future exploitation.” “Lifetime identity protection is the only solution that will give the workers whose data was compromised the peace of mind they deserve,” Congresswoman Norton said. “Because there is no limit on how long personal information can be exploited, Congress must protect these federal employees and contractors in perpetuity. Thank you to Senator Warner for working with me to secure this vital protection for those affected.” This legislation is cosponsored in the Senate by U.S. Sens. Tim Kaine (D-VA), Angela Alsobrooks (D-MD), and Chris Van Hollen (D-MD). In the House of Representatives, this bill is cosponsored by U.S. Reps. Don Beyer (D-VA-08) and Steny Hoyer (D-MD-05). In 2015, OPM identified two separate cybersecurity breaches that compromised the personal data of approximately 22.1 million federal government employees and contractors, as well as the personal data of members of Congress. The malicious cybersecurity invasions, which are believed to have been state-sponsored intrusions by China, resulted in the exposure of about 4.2 million federal government employees, including their Social Security numbers, addresses, financial details, and security clearance files, and background investigation records of about 21.5 million individuals. The dangers related to these breaches will continue to pose significant risks to the affected individuals and our national security in a manner that cannot be remedied, only mitigated. Sen. Warner has long led efforts to strengthen cybersecurity and protect Americans whose personal information has been exposed in major data breaches. In 2015, he introduced the RECOVER Act to better protect federal workers and all those potentially affected by cyberattacks on the Office of Personnel Management (OPM) data system. The bill spurred Congress to include a provision in the Consolidated Appropriations Act of 2017 that provided identity protection coverage to victims for ten years, but it is set to expire September 30, 2026, making the need for lifetime protecting urgent. In 2025, as the Department of Government Efficiency (DOGE) was purging federal programs, Sen. Warner cautioned OPM Acting Director Ezell against prematurely eliminating government contracts that protect the millions of federal employees whose personal information was compromised in the 2015 data breaches. Read the full bill here . Read a one pager of the bill here . ###