Your Free OPM Breach Identity Protection Ends September 30

Free identity protection from the 2015 OPM data breaches ends September 30, 2026, and roughly 22.1 million people are affected by that deadline. If you were a federal employee, applicant, or family member around 2015, there is a good chance your records were in it — and a short list of things worth doing before the coverage lapses.

What Was Taken

Two intrusions were disclosed in 2015. One exposed personnel records for about 4.2 million people. The second compromised roughly 21.5 million background-investigation records. About 3.6 million people were caught in both, for a combined total of approximately 22.1 million.

Those background-investigation files are the sensitive part. Social Security numbers, addresses, family and financial details, and the interview material that goes into a clearance investigation.

The Promise Congress Made

Afterward, Congress required OPM through appropriations law to provide affected individuals with at least 10 years of complimentary identity protection services and no less than $5 million in identity-theft insurance.

Ten years is now up. Enrollees in OPM’s MyIDCare program are receiving notices that their complimentary coverage ends 10 years from their individual enrollment date, and the program itself closes at the end of the fiscal year on September 30, 2026.

There Is a Bill. It Is Not Law.

Sen. Mark Warner, D-Va., and Del. Eleanor Holmes Norton, D-D.C., introduced the RECOVER PII Act this month. It would replace the 10-year limit with lifetime coverage while keeping the identity-theft insurance requirement.

Similar proposals have been introduced before and none became law. Plan around the deadline, not the bill.

Your Countdown Checklist

Today: confirm your enrollment status. Find out whether you are enrolled in MyIDCare and, if so, what your individual enrollment date is. Your coverage end date is driven by that date, not by a single governmentwide cutoff.

This week: save your records. Download and keep copies of any monitoring alerts, reports, or case documentation from the program. When the program closes, that history goes with it. If you ever need to show when suspicious activity first appeared, those documents are the proof.

Before September 30: set the protections that never expire.

• Freeze your credit at all three bureaus. Under 15 U.S.C. § 1681c-1(i), consumer reporting agencies must place and remove a security freeze free of charge. A freeze blocks most new-account inquiries and does not expire on a schedule.
• Claim your free credit reports. Free weekly reports are available at annualcreditreport.com, the site established under the Fair Credit Reporting Act.
• Consider an extended fraud alert if you have been a victim. The fraud-alert provisions live in the same section of the FCRA, 15 U.S.C. § 1681c-1.

Ongoing: watch the places thieves go first. Tax filings, unemployment claims filed in your name, and unfamiliar medical billing are common signals. So are credit inquiries you did not initiate.

A Note for Clearance Holders

If your background-investigation file was in the breach, the exposure is broader than a credit score. Identity misuse can generate financial records you did not create, and financial issues are among the most common reasons clearance eligibility gets questioned. Keeping documentation of any fraud you report is worth doing for that reason alone, separate from the money.

The Bottom Line

The government’s promise on this breach had a 10-year fuse, and it burns out September 30, 2026. The credit freeze and the free reports are permanent, free, and available to you regardless of what Congress does. Setting them up now is the move that does not depend on legislation passing.

Want deadlines like this one tracked for you in plain English? Sign up for our free newsletter.

Legal Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Federal employment situations are fact-specific and time-sensitive. Please consult a qualified federal employment attorney about your specific situation. You can contact Southworth PC at attorneysforfederalemployees.com.