Last Updated: October 5, 2026 (check your own coverage date; we could not verify a universal cutoff or an extension) Reading Time: 9 min

The free identity protection that 22.1 million people received after the 2015 OPM data breaches is expiring. IDX expiration notices, as reported by Nextgov, reportedly use a ten-year enrollment term, so each person's end date falls 10 years after enrollment. Check your account and notice for your actual coverage date. We could not independently verify a universal September 30, 2026 cutoff or an extension. You can check the status of the bill that would extend it, the RECOVER PII Act, at congress.gov.

Why 22.1 Million People Are Losing Coverage

Two separate OPM breaches in 2015 exposed two overlapping groups. The personnel-records breach hit about 4.2 million current and former federal employees. The background-investigation breach was far worse: about 21.5 million people, including 19.7 million clearance applicants and 1.8 million spouses and co-habitants who appeared on SF-86 forms. About 3.6 million people were in both files, which is how you get 22.1 million unique victims. (You will see "nearly 26 million" in some coverage. That figure double-counts the overlap.)

Congress responded in 2017. Section 633 of the Consolidated Appropriations Act (Public Law 115-31) required identity protection for fiscal years 2016 through 2026, effective for at least 10 years, with at least $5 million in identity theft insurance. The government spent up to $756 million across two contracts with ID Experts, now IDX, delivered through the MyIDCare portal.

The required period ran through fiscal 2026. OPM declined to renew the contract, telling GovExec it weighed "the high cost of the program and the very low level of claims in recent years." There is no replacement program.

Your Expiration Date Is Probably Not September 30

September 30, 2026 is the end of fiscal 2026, the last year covered by the law that required the coverage. That date does not establish your personal expiration date. Check your IDX notice and account.

Each person's government-paid coverage ran on its own clock. IDX's expiration notices, as quoted by Nextgov in May 2026, said the monitoring and identity theft insurance had a 10-year term ending 10 years after that person's enrollment date. We could not independently verify a universal September 30, 2026 cutoff or an extension.

Check your IDX notices, account and policy documents for your own expiration date. If your email address has changed, check the address tied to your account. You can also log in at opm.myidcare.com and read the date off the account page.

What You Lose When Coverage Ends vs. What's Free Anyway

FedTools compared every IDX/MyIDCare protection against what federal law already gives you for free. This is the table that should drive your decisions:

Protection IDX/MyIDCare (gov-paid) Free alternative Gap once your coverage ends
Credit monitoring (3 bureaus) Included, real-time alerts Free bureau alerts + weekly reports at AnnualCreditReport.com Partial: free alerts are less immediate
Dark web scanning Included No quality free equivalent Significant
Restoration specialist Included, dedicated case manager None free; $15-$30/month commercial Significant
Identity theft insurance Up to $5,000,000 None free; some renters/homeowners riders cap at $25K-$100K Critical
Credit freeze Not included Free at all 3 bureaus, permanently, by law None. Free version is the strong one
Fraud alert Not included Free at any one bureau, auto-shared with the other two None
Credit reports Separate Free weekly at AnnualCreditReport.com None
SSA account monitoring Not included Free at ssa.gov/myaccount None
Mail fraud detection Not included Free USPS Informed Delivery None

FedTools analysis of IDX/MyIDCare contract coverage vs. permanently free federal-law protections, August 2026.

Read the last column carefully. The monitoring you are losing has decent free substitutes. The freeze you probably never placed is free and stronger than anything IDX offered, because it blocks new-account fraud instead of reporting it afterward. The real losses are the insurance and the restoration help, which only matter after you become a victim.

The 10-Step Checklist for When Your Coverage Ends

1. Confirm your status. Log in at opm.myidcare.com and find your enrollment and expiration dates. If you want IDX's service to continue at your own cost, the sign-in page points to a "Renew Your Protection" option.

2. Download everything. Alert history, monitoring reports, restoration case files, proof of enrollment, and especially the insurance policy terms with claim-filing deadlines. Once the portal closes, this paperwork is gone.

3. File any pending claim now. If you suspect identity theft that began while you were covered, file with IDX in writing and ask how claims on expired policies are handled.

4. Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion each take about 10 minutes online. Free to place, free to lift when you need a loan.

5. Place a fraud alert if you've seen suspicious activity. A free 1-year alert at any bureau is shared with the other two. Confirmed victims can get an extended alert, which lasts seven years, after filing at identitytheft.gov.

6. Set up free weekly credit reports. AnnualCreditReport.com now provides weekly reports from all three bureaus at no cost. The FTC says the weekly program is permanent.

7. Lock down your Social Security account. Create or secure your account at ssa.gov with two-factor authentication before someone else creates it for you. Your SSN was almost certainly in the breach files.

8. Enroll in USPS Informed Delivery. Free email previews of your incoming mail help you catch fraudulent address changes early.

9. Set bank and card alerts to $0. Every major bank offers free transaction alerts. A zero-dollar threshold catches everything.

10. Decide whether to pay for replacement coverage. LifeLock, Aura, and Experian IdentityWorks run $8 to $30 a month. Most cap insurance at $1 million, a fifth of what IDX carried. If your SF-86 was in the breach, with foreign contacts and financial history exposed, the calculus leans toward paying. If only your personnel record was exposed, the free stack above covers most of the risk.

The RECOVER PII Act Is Not Coming to Save You

Senator Mark Warner and Delegate Eleanor Holmes Norton introduced the RECOVER PII Act (S. 5217 and H.R. 10034) on August 3, 2026. The bill text would extend coverage "for the remainder of the life of the affected individual," keep the $5 million insurance floor, and let agencies reimburse employees for privacy tools like data-broker removal services.

Here is the honest read. The bill has zero Republican cosponsors in either chamber. Republicans control both. No markup is scheduled, and a similar 2024 bill died without a vote. The only realistic path is a must-pass spending vehicle. Check congress.gov for the current status of both bills. Track it at congress.gov, but treat the coverage gap as permanent unless the bill moves. For the full bill mechanics, the House cosponsor lineup, and the little-covered agency-reimbursement provision that would cover all 2.3 million feds, see our companion analysis: what the RECOVER PII Act actually does.

Know What Your Federal Benefits Are Worth

The $5 million insurance you are losing was a real, if invisible, piece of your compensation. Use our free Federal Total Compensation Calculator to see the full dollar value of the benefits you still have, from FEHB to TSP matching.

Frequently Asked Questions

Did the OPM data breach affect me?

If you were a federal employee, retiree, or contractor, or applied for a security clearance before 2015, you were probably affected. Spouses and co-habitants listed on SF-86 forms were too. Check opm.myidcare.com for an account.

When did my OPM identity protection expire?

IDX expiration notices, as reported by Nextgov, reportedly use a ten-year enrollment term, so your coverage ends on the 10th anniversary of your enrollment. Check your account and notice for your actual coverage date. We could not independently verify a universal September 30 cutoff or an extension. Log in to opm.myidcare.com to see your date and the paid 'Renew Your Protection' option.

What can't I replace for free?

The restoration specialist and the $5 million insurance. Monitoring, freezes, alerts, and reports all have free equivalents under permanent federal law.

Did Congress extend the coverage?

We could not confirm any extension as of October 5, 2026. The RECOVER PII Act, S. 5217 and H.R. 10034, would make coverage lifetime; check its status at congress.gov, and check your opm.myidcare.com account to see whether your coverage is active. Until you see otherwise, plan as if government-paid coverage is gone.

What single step matters most?

The credit freeze. It is free at all three bureaus, takes 30 minutes total, and blocks most new-account fraud outright, which monitoring never did.

Sources