"Nobody lost a nickel in any of this," What a joke. So the hackers can’t get into my TSP account but they now have my Name, SSN, Address and other information and can use that information to steal my identity sometime in the future. One year of free credit monitoring is useless since my name and SSN are never going to change. When someone steals my ID 3 years from now because of the breach, what is the TSP Board or Serco going to do then? Serco should not have a TSP contract ever again and a class action suit should be filed against both SERCO and the TSP Board.

Data breaches such as this can only be remedied with lifetime credit monitoring, with the offending organization footing the bill. All the dirtbags have to do is wait a year and then set up ghost credit accounts using your name, SSN, etc. This guy should be fired immediately. His response shows he has no idea what the issue of identity theft is all about.

This worries me being a Federal employee. Has any other person noticed that the TSP website will only use 8 character passwords? These are so much easier to hack. The Federal government requires a minimum of 12 characters for a password in all government systems whether created internally or by a contractor. Why does the TSP not follow this? A password with 12 characters or more is tens of thousands of times harder to hack than an 8 character password. I feel this has happened because TSP is behind in online security, starting with allowing users to have adequate length passwords. It is not difficult. Alter the freaking table that handles passwords to allow more characters, update the password field on the website to allow users to type in more characters, test and deploy.

"The Federal government requires a minimum of 12 characters for a password in all government systems whether created internally or by a contractor" That is NOT true. Working for 2 agencies, I know neither uses what you claim. Of course, the more characters you have in a password makes it harder, but it also makes it harder to remember. I rather TSP added questions, icons, CAC, and other ways then just make the password longer...all that will do is make those that want in, take longer. You add what i said, and those hackers would have to know you better than just using a password software..

How much will a year of credit monitoring cost? the TSP PARTICIPANTS? or will the contractor be financially responsible and pass the costs back in their contract. As transparent as possible--isn't very transparent. Why isn't there a TSP investigative activity? Does TSP just wait for the FBI to happen upon cybercrime? Why did the FBI know before TSP? Wasn't the TSP the contractor--the organization that should have been notified first? I would be interested in an indication of the type of hacker--teenagers, organized crime, foreign government, etc. This kind of information can provide insight into what we might be alert to in order to protect ourselves. Why hasn't this information been provided?