The head of the Office of Personnel Management refused Wednesday to estimate how many millions of Americans had been affected by recent attacks on her agency's computers, but she rejected as premature reports that 18 million people's information had been compromised.
OPM Director Katherine Archuleta conceded that the number of people whose data had been compromised could increase from initial estimates.
OPM said this month that it had been the victim of a cyber attack involving personnel data of 4.2 million current and former federal employees. Another attack targeted information of millions more Americans who had applied for security clearances. Some media reports said 18 million had been affected.
"It is my understanding that the 18 million refers to a preliminary, unverified and approximate number of unique Social Security numbers in the background investigations data," Archuleta said at a House of Representatives hearing. "It is a number that I am not comfortable with at this time."
In her second appearance in as many weeks before the House Oversight and Government Reform Committee, Archuleta defended her agency's response to the hacking incidents, the most recent of which was detected in April. It was the second of three Capitol Hill hearings this week on the OPM breaches.
Lawmakers have called the OPM response to questions about the hacking sluggish and incomplete. They have criticized the director, who has been in her job less than two years, and some suggested that she resign or at least shoulder the blame for the sweeping breaches, which U.S. authorities suspect was the work of Chinese hackers.
U.S. Representative Jason Chaffetz of Utah, the Republican committee chairman, exasperated by Archuleta's refusal to provide an estimate, asked whether information on all 32 million current and former federal workers in the OPM database could have been compromised.
Archuleta said the second breach was still being investigated and there might be overlap with data compromised in the other breach. She did say the number of people affected by background investigations data intrusion "may well increase from these initial reports."
Archuleta repeatedly rebuffed lawmakers' attempts to get more information on the numbers of people at risk.
"As much as I want to have all the answers today, I do not want to be in a position of providing you and the affected individuals with potentially inaccurate data," she said.
