It seems like the US government is increasingly incapable of learning basic security lessons. The identity, address, finger prints, social security number and other details of millions of US government workers have been stolen in a massive hack on an unencrypted database and other systems that went unnoticed for four months. 

The hack on the US Office of Personnel Management is being blamed on elements associated with the Chinese military and government, but the impact will go far beyond who did it. This attack may have used information from a previous hack on a US IT security company to gain access. 

Potentially, over 20 million US government workers, past and present, need to update or change significant amounts of their personal information and passwords online. Others, who may have worked in secure, clandestine or other sensitive positions, may need to evaluate their whole personal security situation. 

If these details make their way into the public domain, as often happens with huge data leaks, or are sold to foreign governments, then government workers with security clearances could easily become a target for foreign spies, industrial espionage experts and plain blackmail cases. 

One system, which an OPM staffer described as too old to encrypt, included data like SF-86 forms that relate to clearance for military, police, law enforcement, FBI agents, secret service agents, and diplomatic and intelligence officials around the world. While the Snowden files may have embarrassed the American government, this breach could expose large numbers of key workers to direct and indirect threat. 

Unsurprisingly, the head of the OPM has resigned, but this loss will leave millions of Americans feeling worried about their security and the government's offer of free identity theft advice probably isn't going to leave many of them feeling much securer. 

Before resigning, OPM director Katherine Archuleta said that her department stops some 10 million hack efforts every month, showing how aggressively foreign governments are trying to break into US IT systems. Before the hack, she rejected suggestions that her department's whole system should be taken offline to be made more secure. China has denied involvement in the hack.