Frequently Asked Questions


Basic Information

  1. Why did I get the Notice?

    A court authorized the Notice because people have the right to know about a legal settlement. If you qualify, you could be eligible to receive a payment.

    As discussed further in FAQ 8, you are a class member, and are included in the Settlement, if:

    • You are a U.S. citizen or permanent resident whose personal information was compromised as a result of the breaches of the U.S. Office of Personnel Management’s electronic information systems in 2014 and 2015 or the breach of Peraton’s electronic information systems in 2013 and 2014; and
    • If, after May 7, 2014, you suffered an out-of-pocket expense or lost compensable time: (1) to purchase a credit monitoring product, credit or identity theft protection product, or other product or service designed to identify or remediate the data breaches at issue in this case; (2) to access, freeze or unfreeze a credit report with a credit reporting agency; or (3) as a result of an identity theft incident or to mitigate an identity theft incident.

    To view a copy of the Long Form Notice, click here.

     Back to Top

  2. What is this lawsuit about?

    In the summer of 2015, the U.S. Office of Personnel Management (“OPM”) announced that some of its electronic systems had been breached, resulting in the compromise of personal information of approximately 22.1 million federal government employees, job applicants, and their family members. The Plaintiffs claim that OPM acted in gross disregard of their privacy by failing to put in place adequate data security safeguards, and that Peraton acted negligently by allowing hackers to obtain its security credentials, which were allegedly used to breach OPM’s database. The Defendants deny these claims. OPM denies that it acted “willfully or intentionally”—the standard for holding a federal agency liable for privacy violations under the Privacy Act of 1974, 5 U.S.C. § 552a—and denies that Plaintiffs suffered compensable losses caused by any such violation. Peraton denies that it acted negligently and denies that Plaintiffs’ alleged harm was caused by any conduct of Peraton.

     Back to Top

  3. What is a class action?

    In a class action the plaintiffs act as “class representatives” and sue on behalf of themselves and other people who have similar claims. This group of people is called the “Class,” and the people in the Class are called “class members.” One court resolves the issues for all class members, except for people who exclude themselves from the class. Judge Amy Berman Jackson of the United States District Court for the District of Columbia is in charge of this case. The name of the case is In re: U.S. Office of Personnel Management Data Security Breach Litigation, No. 15-1394 (ABJ) (D.D.C.).

     Back to Top

  4. Who are the Plaintiffs?

    Travis Arnold, Tony Bachtell, Gardell Branch, Myrna Brown, Lilian Colon-McKnight, Paul Daly, Jon Decker (formerly John Doe III), Jane Doe, Jane Doe II, John Doe II, Kelly Flynn, Alia Fuli, Johnny Gonzalez, Orin Griffith, Jennifer Gum, Michael Hanagan, Deborah Hoffman, Cynthia King-Meyers, Todd Kupferer (formerly John Doe), Ryan Lozar, Teresa J. McGarry, Charlene Oliver, Mario Sampedro, Zachary Sharper, Robert Slater, Nancy Wheatley, Kimberly Winsor, Ryan Bonner, Monty Bos, Heather Burnett-Rick, Michael Ebert, Maryann Hibbs, Michael Johnson, Timothy Sebert, Darren Strickland, and Peter Uliano.

     Back to Top

  5. Who are the Defendants?

    The U.S. Office of Personnel Management and Peraton Risk Decision Inc. (formerly known as KeyPoint).

     Back to Top

  6. Why is there a settlement?

    The Court did not decide in favor of Plaintiffs or Defendants. Instead, both sides agreed to a settlement. That way, they avoid the costs and risks of a trial, and class members can get benefits or compensation. The class representatives and Class Counsel think the Settlement is in the best interest of the Class.

     Back to Top

Settlement class members

  1. How do I know if I am one of the 22.1 million people impacted by the OPM cybersecurity incidents?

    In 2015, OPM issued notices to the 22.1 million people impacted by the OPM cybersecurity intrusions. If you did not get notice, but believe you were subject to the breach, you may submit a claim and the Claims Administrator will verify whether or not you were subject to the breach as part of the claims adjudication process.

     Back to Top

  2. Who is in the Settlement?

    You are a class member, and are included in the Settlement, if you are a U.S. citizen or permanent resident whose personal information was compromised as a result of the breaches of the U.S. Office of Personnel Management’s electronic information systems in 2014 and 2015 or the breach of Peraton’s electronic information systems in 2013 and 2014; and if, after May 7, 2014, you suffered an out-of-pocket expense or lost compensable time: (1) to purchase a credit monitoring product, credit or identity theft protection product, or other product or service designed to identify or remediate the data breaches at issue in this case; (2) to access, freeze or unfreeze a credit report with a credit reporting agency; or (3) as a result of an identity theft incident or to mitigate an identity theft incident.

    Excluded from this Class are Class Counsel and their employees; any judicial officers to whom this case is assigned and their respective staffs; mediators and their respective staffs; and attorneys from the Department of Justice and the Office of Personnel Management, and their respective staffs, who worked directly and personally on this matter.

     Back to Top

  3. Who can get money from the Settlement, and how much?

    You are eligible to make a claim under the Settlement if you are a “class member,” defined as:

    • A U.S. citizen or permanent resident whose personal information was compromised as a result of the breaches of the U.S. Office of Personnel Management’s electronic information systems in 2014 and 2015 or the breach of Peraton Risk Decision Inc.’s (then KeyPoint’s) electronic information systems in 2013 and 2014; and
    • Between May 7, 2014 and January 31, 2022, you suffered out-of-pocket expense or loss of compensable time: (1) to purchase a credit monitoring product, credit or identity theft protection product, or other product or service designed to identify or remediate the data breaches; (2) to access, freeze or unfreeze a credit report with a credit reporting agency; or (3) as a result of an identity theft incident or to mitigate an identity theft incident.

    You are only eligible to make a claim if you suffered an out-of-pocket expense or loss of compensable time within at least one of the three categories listed above.

    If your claim is found valid, you will be paid $700 or the actual amount of the claim, whichever is higher, to a maximum of $10,000. However, the amount of individual claims will be reduced in equal proportion before claimants are paid if the total value of all valid claims plus any incentive award payments awarded by the Court to named plaintiffs exceeds the $63,000,000 settlement fund amount. Government records will be used to verify that you were subject to the breaches, but the Claims Administrator will be solely responsible for determining the validity of claims and the amount of payment.

    The Settlement provides for a minimum $700 payment for reasonably documented claims of unreimbursed out-of-pocket expenditures made by a class member between May 7, 2014 and January 31, 2022 for reasonable costs incurred in connection with the 2014 and 2015 cyberattacks of OPM’s electronic information systems and/or the 2013 and 2014 cyberattacks of Peraton’s electronic information systems.

    For more information on how to file a claim, see FAQ 14.

     Back to Top

  4. What should I do if I am not sure whether I am included?

    If you are not sure whether you are included in the Class, you can ask for free help by calling the Claims Administrator at 1-855-917-3567 or sending an email to info@OPMDataBreach.com for more information.

     Back to Top

Settlement Benefits

  1. What does the Settlement provide?

    The Defendants will pay $63,000,000 into a Settlement Fund, which will be distributed to class members who submit valid claims, after deducting incentive awards to named plaintiffs if such awards are approved by the Court. Government records will be used to verify that claimants were subject to the data breaches, but the parties will have no role in determining the validity of claims.

     Back to Top

  2. Why is the Settlement limited to individuals who suffered out-of-pocket losses?

    Settlement payments are only available to individuals subject to the data breaches who experienced economic loss. This limitation results from the Supreme Court’s ruling that compensable damages under the Privacy Act are limited to economic (pecuniary) loss: “The basic idea is that Privacy Act victims … are barred from any recovery unless they can first show actual—that is, pecuniary or material—harm.” FAA v. Cooper, 566 U.S. 284, 296 (2012).

     Back to Top

  3. When will I get my payment?

    The Court will hold a hearing on October 14, 2022, at 10:00 a.m., to decide whether to approve the Settlement. Payments will be made after the Settlement is approved and becomes final (meaning there is no appeal from the order approving the Settlement). Please be patient.

    For more information regarding the hearing, see FAQ 32

     Back to Top

How to File a Claim

  1. How do I participate in the Settlement? What do I need to do?

    If you were subject to the data breaches and experienced an out-of-pocket loss that you believe is attributable to the breaches in any of the three categories listed in FAQ 8 and FAQ 9, you can make a claim by filling out and submitting the claim form.

    If you are claiming out-of-pocket expenses under the Settlement, you must describe the expenses, their amount, and when and why you incurred them. If your claim is for expenses or compensable time related to a credit freeze, credit monitoring, identity theft protection, or similar services, you must also attest that you incurred those losses in response to the data breaches in this case and not as a result of any other compromise of your personal information.

    Your claim must be reasonably documented—you must enclose or upload documentation sufficient to show (a) the amount of unreimbursed loss that you suffered, and (b) why you believe that the loss is reasonably attributable to the data breaches in the case. Personal statements or declarations are not reasonable documentation under the Settlement, but they may be used to provide clarification, context, or support for other documentation submitted in support of a claim.

    For expenditures of money, the documentation may include credit card or bank statements, emails, invoices, receipts, or telephone records, including photographs of the same.

    For compensable lost time, the documentation may include pay stubs, invoices, other billing records, or emails or other communications or records reflecting time taken off work. If you are claiming compensable lost time, you must describe the relevant actions you took and the time each action took, and enclose or attach documentation showing that the lost time was compensable—in other words, showing leave from hourly work or paid time off from salaried work. Government benefits, such as Social Security retirement or disability payments, do not constitute income that can be lost for purposes of a Settlement claim. A $25 hourly rate will apply to compensable lost time, except that if you are claiming compensable time and the total value of your claim exceeds $700, you must submit documentation demonstrating a specific hourly rate.

    Claim forms may be completed online through this website here or is available for download here. You can also contact the Claims Administrator to request a paper claim form by telephone (1-855-917-3567), email (info@OPMDataBreach.com) or U.S. mail (Claims Administrator, P.O. Box 4719, Portland, OR 97208-4719). Submit the claim form by filing it out and sending it to the U.S. mail address listed above.

     Back to Top

  2. Do I need to provide any documentation?

    Yes. Your claim must be reasonably documented—you must enclose or upload documentation sufficient to show (a) the amount of unreimbursed loss that you suffered, and (b) why you believe that the loss is reasonably attributable to the data breaches in the case. For expenditures of money, this documentation may include credit card or bank statements, emails, invoices, receipts, or telephone records, including photographs of the same.

    For compensable lost time, this documentation may include pay stubs showing time off taken to attend to issues arising from the breach, invoices, other billing records, or emails or other communications or records reflecting time taken off work. Personal statements or declarations are not reasonable documentation under the Settlement, but they may be used to provide clarification, context, or support for other documentation submitted in support of a claim.

    It is important for you to upload or enclose documents that show what happened and how much money you lost or spent.

    Documentation is required as the Claims Administrator, Epiq is a third party hired to assist in disseminating the Court-approved Notice, collecting the claims submitted by class members, applying the Court-approved eligibility criteria, and making award distributions after all deadlines have passed and all claims are determined.

    You must provide documentation of your valid out-of-pocket loss or compensable lost time to qualify for an award. The Claims Administrator cannot assist you in locating that information.

     Back to Top

  3. What is the deadline for submitting a claim form?

    To be eligible for payment, claim forms must be submitted electronically online or postmarked no later than December 23, 2022.

     Back to Top

  4. How do I get a claim form?

    Claim forms can be submitted online through this website here. You can also download a claim form here or request that a claim form be mailed to you by contacting the Claims Administrator to request a paper claim form by telephone (1-855-917-3567), email (info@OPMDataBreach.com) or U.S. mail (Claims Administrator, P.O. Box 4719, Portland, OR 97208-4719)

     Back to Top

  5. Can I file on behalf of a deceased individual?

    No. Only living individuals are entitled to compensation.

     Back to Top

  6. Can I submit my claim form/documentation through email/fax?

    No. Claim forms must be completed either by returning a paper claim form via mail or submitting your claim form online on or before December 23, 2022. If filing online, be sure to keep your claim confirmation code as proof of timely filing.

    If you would like to mail your completed claim form, your claim form must be postmarked no later than December 23, 2022, and mailed to the following address:

    OPM Data Breach Settlement
    Claims Administrator
    P.O. Box 4719
    Portland, OR 97208-4719

     Back to Top

  7. How do I correct a mistake on my claim after I submitted it?

    If you would like to amend any portion of your claim submission or submit additional documentation, you may do so via U.S. mail to the Claims Administrator at:

    OPM Data Breach Settlement
    Claims Administrator
    P.O. Box 4719
    Portland, OR 97208-4719

    In order to make any changes or provide additional documentation, please include your name, address, confirmation code (if applicable), and a summary of the changes. If you do not include this information, the Claims Administrator may not be able to link the additional support and/or changes to the correct claim, which could delay verification of your claim or result in your claim being denied.

     Back to Top

  8. How can I verify that my claim was received?

    If you received a confirmation code from your online filing, this is your proof of receipt.

    If you mailed your claim form, you can call the Claims Administrator at 1-855-917-3567 or email info@OPMDataBreach.com to confirm. Please note that, depending on when you mailed your claim form, it may still be in transit or may not have made it through the intake process.

     Back to Top

Excluding Yourself

  1. How do I get out of the Settlement?

    To opt out, you must send a letter via U.S. mail to the address below and include the following in your letter:

    • To confirm that you were a victim of the data breaches, your full name (or, if different, your full name at the time of the data breaches), and one of the following: (1) your date of birth and the last four digits of your Social Security number, or (2) the PIN that you received from the OPM Verification Center in connection with OPM’s offer of identity protection services.
    • Your current address;
    • A statement that you want to opt out of the Settlement;
    • A statement that you are a class member because you were subject to the data breaches and you experienced one of the forms of loss in the class definition; and
    • Your signature.

    OPM Data Breach Settlement
    Claims Administrator
    P.O. Box 4719
    Portland, OR 97208-4719

    Opt-out requests must be postmarked no later than September 9, 2022.

    The Claims Administrator will file your request for exclusion with the Court. A request for exclusion must be exercised individually and not on behalf of a group. Please note that Personal Identifying Information (PII) will not be filed with the Court on the open public docket.

    If your request to exclude yourself from the Class is not postmarked by deadline of September 9, 2022, you will remain part of the Class and will be bound by the orders of the Court in this lawsuit and by the terms of the Settlement if it is approved, whether or not you submit a claim for payment. If you do not wish to be bound by the decisions or Settlement in this case, you must request exclusion.

     Back to Top

  2. If I am a class member and don’t opt out, can I sue the Defendants for the same thing later?

    No. If you are a class member (see FAQ 8), unless you opt out, you give up the right to sue OPM and Peraton for the claims resolved by the Settlement. So if you are a class member and you want to try to pursue your own lawsuit, you must opt out.

     Back to Top

  3. What happens if I opt out?

    If you opt out of the Settlement, you will not have any rights as a member of the Class under the Settlement; you will not receive any payment as part of the Settlement; you will not be bound by any further orders or judgments in this case; and you will keep the right, if any, to sue on the claims alleged in the case at your own expense.

     Back to Top

The Lawyers Representing You

  1. Do I have a lawyer in this case?

    Yes. The Court appointed Daniel C. Girard of Girard Sharp LLP and other attorneys to represent you and the other class members. These lawyers are called Class Counsel. You will not be charged for their services.

    Class Counsel can be reached by calling 1-415-981-4800 or emailing OPM@girardsharp.com.

     Back to Top

  2. Should I get my own lawyer?

    You do not need to hire your own lawyer. If you want your own lawyer, you may hire one, but you will be responsible for any payment for that lawyer’s services. For example, you can ask your own lawyer to appear in court for you if you want someone other than Class Counsel to speak for you. You may also appear for yourself without a lawyer.

     Back to Top

  3. How will the lawyers be paid?

    You do not have to pay Class Counsel. Class Counsel, who have not been paid for their services in this case since it began, will seek an award of attorneys’ fees and reimbursement for litigation costs that they advanced in pursuing the claims, to be paid separately by the United States Government. In other words, attorneys’ fees and cost reimbursements approved by the Court will not come out of or reduce the Settlement Fund. The fees will compensate Class Counsel for investigating the facts, litigating the case, and negotiating the Settlement. The application for attorneys’ fees will be posted on the Settlement website prior to the deadline for objecting to the Settlement.

    The application for attorneys’ fees will be posted on this website on or shortly after July 21, 2022, several weeks before the deadline to object.

    Class Counsel will also ask the Court to approve incentive award payments of $3,000 to each of the 36 individuals who served as named plaintiffs. The Defendants will have the right to oppose these award payments. If approved, these awards will be paid out of Peraton’s contribution to the Settlement Fund.

    OPM will pay the costs of providing notice and administering the Settlement separately from the Settlement Fund.

     Back to Top

Objecting to the Settlement

  1. How do I tell the Court if I don’t like the Settlement?

    If you are a class member and you do not opt out of the Settlement, you can ask the Court to deny approval of the Settlement by filing an objection. You can’t ask the Court to order a different settlement, the Court can only approve or deny this Settlement. If the Court denies approval, no settlement payments will be sent out and the lawsuit will continue. If that is what you want to happen, you must object.

    You may object to the proposed Settlement in writing. You may also appear at the Fairness Hearing, either in person or through your own attorney. If you appear through your own attorney, you are responsible for paying that attorney.

    To object, you must file a document with Epiq, the appointed Claims Administrator, saying that you object to the proposed Settlement in In re: U.S. Office of Personnel Management Data Security Breach Litigation, No. 15-1394 (ABJ) (D.D.C.). You must include:

    • Your name, address, and signature;
    • A statement setting forth the specific reason(s), if any, for the objection, including any legal support for and any evidence that you wish to introduce in connection with your objection;
    • A statement as to whether your objection applies only to you, to a specific subset of the Class, or to the entire Class;
    • A statement as to whether you intend to appear at the Fairness Hearing;
    • A signed statement that you are a class member because you were subject to the data breaches and you experienced one of the forms of loss in the class definition; and
    • To confirm that you were a victim of the data breaches, your full name (or, if different, your full name at the time of the data breaches) and one of the following: (1) your date of birth and the last four digits of your Social Security number, or (2) the PIN that you received from the OPM Verification Center in connection with OPM’s offer of identity protection services.

    Mail the objection by First Class U.S. Mail to the following address:

    OPM Data Breach Settlement
    Claims Administrator
    P.O. Box 4719
    Portland, OR 97208-4719

    Your objection must be received by the Claims Administrator no later than September 9, 2022 to be considered by the Court.

     Back to Top

  2. What is the difference between objecting and opting out?

    Objecting is telling the Court that you don’t like something about the Settlement. You can object to the Settlement only if you are a class member and do not opt out of the Settlement.

    Opting out of the Settlement is telling the Court that you don’t want to be part of the Settlement.

    If you opt out of the Settlement, you cannot object to it because it does not affect you. You cannot both opt out of and object to the Settlement.

     Back to Top

The Fairness Hearing

  1. When and where will the Court decide whether to approve the Settlement?

    The Court will hold a Fairness Hearing at 10:00 a.m. on October 14, 2022, at the federal courthouse located at 333 Constitution Ave., N.W., Washington, D.C. 20001.

    At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate. If there are objections, the Court will consider them. The Court will listen to people who have asked to speak at the hearing.

    The Court may also decide how much Class Counsel should receive in fees and expense reimbursements. After the hearing, the Court will decide whether to approve the Settlement.

    The Court may reschedule the Fairness Hearing or change any of the deadlines described on this website or in the Notice. The date of the Fairness Hearing may change without further notice to the class members. Be sure to check this website for news of any such changes. You can also access the case docket via the Court’s Public Access to Court Electronic Records (PACER) system at https://ecf.dcd.uscourts.gov.

     Back to Top

  2. Do I have to come to the hearing?

    No. Class Counsel will answer any questions the Court may have. You may attend at your own expense if you wish. If you send an objection, you do not have to come to the hearing to talk about it. As long as you mailed or filed your written objection on time, the Court will consider it. You may also pay your own lawyer to attend, but it is not necessary.

     Back to Top

  3. May I speak at the hearing?

    You may ask the Court for permission to speak at the Fairness Hearing. To do so, you must include a statement in your written objection (discussed above at FAQ 28) that you intend to appear at the hearing. Be sure to include your name, address, and signature as well.

     Back to Top

If You Do Nothing

  1. What happens if I do nothing at all?

    If you do nothing and you are a class member, you will get no money from this Settlement, and you will not be able to sue the Defendants for the conduct alleged in this case. If you do nothing and you are not a class member, the Settlement will not affect or release any individual claim you may have.

     Back to Top

  2. What am I giving up if I stay in the Class?

    If you are a class member, unless you exclude yourself with an opt-out request (see FAQ 22), you cannot sue, continue to sue, or be part of any other lawsuit against these Defendants about the issues in this case. The “Releases” section in the Settlement Agreement describes the legal claims that you give up if you remain in the Settlement Class. The Settlement Agreement can be viewed here.

     Back to Top

Getting More Information

  1. Are more details about the Settlement available?

    This website and the Notice summarize the Settlement. More details are in the Settlement Agreement and other case documents. You can get a copy of these documents here, by accessing the docket in this case through the Court’s Public Access to Court Electronic Records or “PACER” system at https://ecf.dcd.uscourts.gov or by visiting the office of the Clerk of the Court for the United States District Court for the District of Columbia, 333 Constitution Ave., N.W., Washington, D.C. 20001, Room 1225, between 9:00 a.m. and 4:00 p.m., Monday through Friday, excluding Court holidays.

    If you have additional questions. you can contact the Claims Administrator at the following:

    OPM Data Breach Settlement
    P.O. Box 4719
    Portland, OR 97208-4719
    1-855-917-3567
    info@OPMDataBreach.com

    Class Counsel can be reached by calling 1-415-981-4800 or emailing OPM@girardsharp.com.

    Please do not telephone the Court or the Court Clerk’s office to inquire about this Settlement or the claim process.

     Back to Top

  2. How can I protect myself from identity theft?

    Congress authorized “complimentary identity protection coverage”—including “not less than $5,000,000 in identity theft insurance”—for all individuals whose personal information was compromised in the data breaches at issue in this case, through September 2026. OPM contracted with ID Experts (now known as IDX), which has been providing such individuals, at no charge, a comprehensive set of credit monitoring, identity theft protection services, and data theft insurance products known as MyIDCare.

    These services remain available to the 22.1 million individuals impacted by the OPM cybersecurity incidents. If you are eligible and have not already done so, you can sign up for the free credit monitoring and identity protection services. The Federal Government has set up a Verification Center to assist individuals who believe their data may have been impacted by the OPM Cybersecurity incidents announced in 2015.

    The Verification Center will assist individuals who previously received a letter notifying them that their data had been impacted by the cyber incidents, and would like to have a copy of their letter resent. The Verification Center will also assist those who believe their data may have been impacted by the incidents but did not receive a notification letter. The Verification Center will provide eligible individuals with a 25-digit PIN that can be used to enroll in the complimentary credit monitoring services. You may access the Verification Center at https://opmverify.dmdc.osd.mil. Those needing assistance with submitting their information may call the Verification Center at 1-800-750-3004 Monday through Saturday, between 9:00 a.m. and 9:00 p.m. Eastern Time. More information on how to enroll in the complimentary credit monitoring services is available at: www.opm.gov/cybersecurity.

     Back to Top

  3. How can I update my address?

    If you have not filed your claim, you may simply provide your current address in the online claim portal or by providing your current address on the paper claim form. If you already filed your claim, please send any address change requests in writing to:

    OPM Data Breach Settlement
    P.O. Box 4719
    Portland, OR 97208-4719
    info@OPMDataBreach.com

    Please include your name, prior address and your confirmation code (if applicable).

     Back to Top