The US’ Office of Personnel Management (OPM) said on Thursday that data stolen from it concerns millions more Americans than was previously announced.
This is in addition to the data on 4.2 million current and former federal workers which the OPM said was also stolen in a “separate but related” breach.
The data stolen from OPM servers included social security numbers and other sensitive information such as background information on 21.5 million people.
“It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government," FBI Director James Comey said on Thursday.
The agency said that data on 19.7 million people who applied for security clearances was also exposed. The remaining 1.8 million concerned people close to the applicants such as their spouses and cohabitants.
Lawmakers from across the US political spectrum have demanded OPM Director Katherine Archuleta’s resignation.
“President Barack Obama must take a strong stand against incompetence in his administration and install new leadership at OPM,” said Republican House of Representatives Speaker John Boehner.
"Director Archuleta's slow and uneven response has not inspired confidence that she is the right person to manage OPM through this crisis," added Virginia Democratic Senator Mark Warner.
“It is time for her to step down, and I strongly urge the administration to choose new management with proven abilities to address a crisis of this magnitude with an appropriate sense of urgency and accountability.”
However, the White House said Obama maintains confidence in Archuleta.
“I am committed to the work that I am doing at OPM," Archuleta told reporters. "I have trust in the staff that is there.”
Several US officials, requesting anonymity, told various media outlets that the hackers were from China but did not openly blame the Chinese government.
Obama’s security advisor said on Thursday that the government wasn’t yet ready to say who was behind the attack, adding “Just because we're not doing public attribution does not mean that we're not taking steps to deal with the matter.”