Data Stolen in OPM Breach Used in Loan Fraud Scheme
19.6.18 securityweek Incindent

Two individuals pleaded guilty recently over their role in a scheme that involved fraudulent loans obtained using personal information stolen in the massive breach at the U.S. Office of Personnel Management (OPM).

A Maryland woman, Karvia Cross, pleaded guilty on Monday and a co-defendant, Marlon McKnight, admitted being involved in the scheme on June 11. The two pleaded guilty to conspiracy to commit bank fraud and aggravated identity theft. Cross will be sentenced on October 26.

According to authorities, the fraudsters used personal information stolen from the OPM to obtain personal and vehicle loans through the Langley Federal Credit Union (LFCU).

In 2015 and 2016, the financial organization received many online membership and loan applications using identity data compromised in the OPM breach, and the requests were approved prior to LFCU learning that they had been sought using stolen identities.

The fraudsters then withdrew the fraudulently obtained proceeds from the LFCU accounts they had opened.

It’s unclear how the fraudsters obtained the data stolen in the OPM breach. U.S. authorities have blamed Chinese hackers for the attack and last year the FBI even arrested a Chinese national suspected of being involved in the development of the Sakura exploit kit, which was allegedly used in the campaign.

Described as one of the largest breaches of government data in U.S. history, the OPM incident occurred in 2014 and 2015, and it resulted in the theft of personal information from the background checks of roughly 22 million people.