Two individuals pleaded guilty recently over their role in a scheme that involved fraudulent loans obtained using personal information stolen in the massive breach at the U.S. Office of Personnel Management (OPM).
A Maryland woman, Karvia Cross, pleaded guilty on Monday and a co-defendant, Marlon McKnight, admitted being involved in the scheme on June 11. The two pleaded guilty to conspiracy to commit bank fraud and aggravated identity theft. Cross will be sentenced on October 26.
According to authorities, the fraudsters used personal information stolen from the OPM to obtain personal and vehicle loans through the Langley Federal Credit Union (LFCU).
In 2015 and 2016, the financial organization received many online membership and loan applications using identity data compromised in the OPM breach, and the requests were approved prior to LFCU learning that they had been sought using stolen identities.
The fraudsters then withdrew the fraudulently obtained proceeds from the LFCU accounts they had opened.
It’s unclear how the fraudsters obtained the data stolen in the OPM breach. U.S. authorities have blamed Chinese hackers for the attack and last year the FBI even arrested a Chinese national suspected of being involved in the development of the Sakura exploit kit, which was allegedly used in the campaign.
Described as one of the largest breaches of government data in U.S. history, the OPM incident occurred in 2014 and 2015, and it resulted in the theft of personal information from the background checks of roughly 22 million people.
UPDATE. DOJ clarifies that it doesn’t actually know for sure that the data came from the OPM breach.
Related: Leadership, Not Technology, Blamed for Huge OPM Breach
Related: OPM Suspends Background Check System to Patch Security Bug
Related: OPM-Impersonating Spam Emails Distribute Locky Ransomware