In re U.S. Office of Personnel Management Data Security Breach Litigation

The United States Office of Personnel Management (OPM) (defendant) was the federal government’s human-resources agency. OPM suffered data breaches in 2009 and 2012. Around this time period, OPM’s inspector general issued audit reports warning OPM about several problems with its information security. At one point, the inspector general recommended that OPM shut down its systems until greater security could be added. Despite these warnings and the recommendation, OPM carried forward with the status quo. In 2014, OPM was hit with another cyberattack, resulting in, according to several past and present employees and prospective employees (collectively, the employees) (plaintiffs), the theft of personal information of millions of past, present, and prospective employees. The information included Social Security numbers, birthdates, fingerprints, and information collected in prospective employees’ background checks. The employees sued OPM under the Privacy Act, 5 U.S.C. § 552a (the act). The employees alleged that as a result of the data breach, they had had fraudulent accounts opened in their names, false tax returns filed, and unauthorized purchases made in their names, and in many cases had incurred legal fees resulting from these occurrences. The employees also alleged that many of them had incurred costs to buy credit-protection services. OPM argued that it had sovereign immunity and thus was not subject to liability.