The massive theft of federal employee data that the Obama administration announced on Thursday will cost taxpayers — possibly as much as $20 million.

The Office of Personnel Management said Thursday that in response to the data breach, it had contracted with the company CSID to provide services to the current and former federal workers who had their personal information stolen. OPM said as many as 4 million people could be affected.

"This comprehensive, 18-month membership includes credit report access, credit monitoring, identity theft insurance, and recovery services," OPM said.

On Friday, OPM announced a final contract to provide those services with Winvale Group LLC. Winvale is the main contractor, and CSID is the subcontractor.

While the services will be free for federal workers, they won't be free for taxpayers. According to the contract award announcement, OPM will pay Winvale $20,760,741.63 for services designated as "call 1" in the contract.

Those services include sending out 2.1 million emails to affected employees and 1.1 million letters, plus call center support, credit monitoring and ID theft and recovery services for 3.2 million people. A spokesman for Winvale said the emails would be going out on Monday.

While that first contract has been finalized, OPM spokesman Sam Schumach indicated Friday that the total cost of services could be lower than $20.8 million, because it will depend on how much people use these services.

"We don't know the exact cost for these services at this time because some of the services are based on actual consumption," he said.

But at the same time, he seemed to indicate the costs could rise, since there is an ongoing investigation into the data breach, and more theft could be discovered. "[I]f that occurs, OPM will conduct additional notifications as necessary," he said.

Schumach said the OPM contract with Winvale is a "blanket purchase agreement" that government officials from any agency can use. Workers across the entire federal government could be affected.

In a statement to the Washington Examiner, Winvale CEO Kevin Lancaster said his company's services will be able to be accessed starting next week.

"As announced, OPM will begin sending email notifications to those affected beginning on Monday, June 8th, who will then have immediate access to our services," he said. "Winvale and CSID are committed to providing every added protection at no cost to enrollees, including 18 months of credit monitoring and an additional $1 million in identity theft insurance, among many other safeguards provided through our CyberAgent identity theft prevention platform."