In April 2015, the OPM discovered that personal data had been stolen from 4.2 million current and former Federal government employees. The victims of this breach have been notified. In June 2015, while investigating the previous incident, OPM discovered an additional compromise of background investigation records belonging to 21.5 million current, former and prospective Federal employees and contractors.

After the first breach, which was announced in June, the OPM reportedly spent more than $20 million for identity protection firm CSID to notify affected individuals and provide them with identity protection services. Government personnel, however, complained of website crashes and multi-hour call center waiting times when they called to get basic information.

Some victims also complained that the notifications looked like malicious emails, came from a dot.com email address and contained a link to a commercial website. This time, email notifications will come from either a dot.mil or dot.gov address.

“As with any breach, time is of the essence and this is no different,” Ondrej Krehel, founder/principal of the New York City-based cybersecurity intelligence firm LIFARS, explained. “The problem though, is that it could potentially be quite a while before everything is shored up, and if it even makes the deadline. By the time they find out, they'll already be months behind and then they still have investigation and remediation to handle.”

Another expert said the new notification plan could make the situation worse for some victims.

“First of all, the nature of the data stolen requires a lifetime of protection, not just three years,” Stu Sjouwerman, founder/CEO of the Clearwater, Fla.-based Knowbe4, said. “Second, you can count on the bad guys cross-referencing the OPM hack and the Ashley Madison data and start spear-phishing and/or blackmailing the data breach victims. Instead of spending 130 million in credit monitoring, that money would have been spent much better to prevent the hack to start with!”