The Office of Personnel Management announced Thursday that a total of 22.1 million people had their personnel records or background check information stolen in two separate data breaches, a huge addition to the 4.2 million people that OPM originally said were affected.
Despite this, OPM Director Kathleen Archuleta said she wouldn't be stepping down, even though calls are growing for her to be removed given that the data breach is thought to be the largest in the government's history.
"I am committed to the work that I am doing at OPM," Archuleta said, adding that she has confidence in her leadership team. She also wouldn't say who is behind the data theft, even though it's suspected that someone in China was behind it.
OPM tried to downplay the giant new total by burying it in a confusing press release titled, "OPM announces steps to protect federal workers and others from cyber threats." But OPM officials explained on a call with reporters how it got to its new number.
In June, OPM said 4.2 million people had their personnel records stolen, and on Thursday, OPM said that number hasn't changed. However, it announced that 21.5 million people were hit in a separate breach that involved the theft of background data.
"The team has now concluded with high confidence that sensitive information, including the Social Security Numbers of 21.5 million individuals, was stolen from the background investigation databases," OPM said. "This includes 19.7 million individuals that applied for a background investigation, and 1.8 million non-applicants, predominantly spouses or co-habitants of applicants. "
OPM also said "some records also include findings from interviews conducted by background investigators and approximately 1.1 million include fingerprints."
Of the original group of 4.2 million people hit in the personnel records theft, 3.6 million of them were also impacted by the theft of background data. Therefore, the total number of unique people affected is 21.5 million plus another 600,000 who were only hit by the personnel records breach, or 22.1 million.
"I'm sure the adversary has my SF-86 now," FBI Director James Comey testified before the Senate earlier this week. "My SF-86 lists every place I've ever lived since I was 18," he said, referencing the comprehensive form every government worker who needs security clearances must fill out. "Every foreign travel I've ever taken. All of my family ... their addresses," he said about what is in the forms, which were accessed in the second hack that OPM revealed last month and said occurred last year.
House Oversight and Government Reform Committee Chairman Jason Chaffetz, R-Utah, reacted to the news by renewing his call for President Obama to fire Archuleta and Chief Information Officer Donna Seymour.
"As I've said since June 16, after the Oversight Committee held the first hearing on this disastrous data breach, Director Archuleta and CIO Donna Seymour need to resign or be removed," he said.
"Their negligence has now put the personal and sensitive information of 21.5 million Americans into the hands of our adversaries," he added. "Such incompetence is inexcusable. Again, I call upon President Obama to remove Director Archuleta and Ms. Seymour immediately."
RELATED: OPM's hack mitigation costs likely to soar
Earlier this week, it became clear that OPM's costs for mitigating the problem would likely expand as the number of people with stolen data expanded.
OPM said it was offering the same help for the group of 21.5 million people that it was offering to the original 4.2 million people: credit monitoring and limited liability insurance for losses caused by identity theft. Only instead of offering just 18 months of credit monitoring, OPM is now offering 3 years.