Last Updated: August 14, 2026 Reading Time: 9 min

The free identity protection that 22.1 million people received after the 2015 OPM data breaches is shutting down. Coverage ends on each person's 10-year enrollment anniversary, and the entire program closes no later than September 30, 2026. Some enrollees have already lost coverage and don't know it.

Why 22.1 Million People Are Losing Coverage

Two separate OPM breaches in 2015 exposed two overlapping groups. The personnel-records breach hit about 4.2 million current and former federal employees. The background-investigation breach was far worse: about 21.5 million people, including 19.7 million clearance applicants and 1.8 million spouses and co-habitants who appeared on SF-86 forms. About 3.6 million people were in both files, which is how you get 22.1 million unique victims. (You will see "nearly 26 million" in some coverage. That figure double-counts the overlap.)

Congress responded in 2017. Section 633(a) of the Consolidated Appropriations Act (Public Law 115-31) required at least 10 years of identity protection and at least $5 million in identity theft insurance for every victim. The government spent up to $756 million across two contracts with ID Experts, now IDX, delivered through the MyIDCare portal.

The 10 years are now up. OPM handed the contract to GSA in September 2025 and declined to renew it, citing "the high cost of the program and the very low level of claims in recent years." There is no replacement program.

Your Expiration Date Is Probably Not September 30

This is the detail most coverage gets wrong. September 30, 2026 is the program-wide shutdown, not your personal expiration date.

Your coverage ends on the 10th anniversary of the day you enrolled. Enrolled in August 2015? You may already be unprotected. Enrolled in early 2016? Your date lands sometime before the September 30 cutoff. Nobody keeps coverage past September 30 regardless of when they signed up.

IDX has been emailing enrollees as their anniversaries arrive. If you changed email addresses since 2016, that notice went to an inbox you no longer check. Log in at opm.myidcare.com and read your actual date off the account page.

What You Lose October 1 vs. What's Free Anyway

FedTools compared every IDX/MyIDCare protection against what federal law already gives you for free. This is the table that should drive your decisions:

Protection IDX/MyIDCare (gov-paid) Free alternative Gap after Oct. 1
Credit monitoring (3 bureaus) Included, real-time alerts Free bureau alerts + weekly reports at AnnualCreditReport.com Partial: free alerts are less immediate
Dark web scanning Included No quality free equivalent Significant
Restoration specialist Included, dedicated case manager None free; $15-$30/month commercial Significant
Identity theft insurance Up to $5,000,000 None free; some renters/homeowners riders cap at $25K-$100K Critical
Credit freeze Not included Free at all 3 bureaus, permanently, by law None. Free version is the strong one
Fraud alert Not included Free at any one bureau, auto-shared with the other two None
Credit reports Separate Free weekly at AnnualCreditReport.com None
SSA account monitoring Not included Free at ssa.gov/myaccount None
Mail fraud detection Not included Free USPS Informed Delivery None

FedTools analysis of IDX/MyIDCare contract coverage vs. permanently free federal-law protections, August 2026.

Read the last column carefully. The monitoring you are losing has decent free substitutes. The freeze you probably never placed is free and stronger than anything IDX offered, because it blocks new-account fraud instead of reporting it afterward. The real losses are the insurance and the restoration help, which only matter after you become a victim.

The 10-Step Checklist Before September 30

1. Confirm your status and expiration date. Log in at opm.myidcare.com, or create an account if you were affected but never enrolled. Find your enrollment date and your expiration date.

2. Download everything. Alert history, monitoring reports, restoration case files, proof of enrollment, and especially the insurance policy terms with claim-filing deadlines. Once the portal closes, this paperwork is gone.

3. File any pending claim now. If you have any suspected identity theft, file with IDX before your coverage ends and get written confirmation of how open claims will be handled after expiration.

4. Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion each take about 10 minutes online. Free to place, free to lift when you need a loan.

5. Place a fraud alert if you've seen suspicious activity. A free 1-year alert at any bureau is shared with the other two. Confirmed victims can get a 7-year extended alert after filing at identitytheft.gov.

6. Set up free weekly credit reports. AnnualCreditReport.com now provides weekly reports from all three bureaus at no cost.

7. Lock down your Social Security account. Create or secure your account at ssa.gov with two-factor authentication before someone else creates it for you. Your SSN was almost certainly in the breach files.

8. Enroll in USPS Informed Delivery. Free email previews of your incoming mail help you catch fraudulent address changes early.

9. Set bank and card alerts to $0. Every major bank offers free transaction alerts. A zero-dollar threshold catches everything.

10. Decide whether to pay for replacement coverage. LifeLock, Aura, and Experian IdentityWorks run $8 to $30 a month. Most cap insurance at $1 million, a fifth of what IDX carried. If your SF-86 was in the breach, with foreign contacts and financial history exposed, the calculus leans toward paying. If only your personnel record was exposed, the free stack above covers most of the risk.

The RECOVER PII Act Is Not Coming to Save You

Senator Mark Warner and Delegate Eleanor Holmes Norton introduced the RECOVER PII Act (S. 5217 and H.R. 10034) on August 3, 2026. The bill text would extend coverage "for the remainder of the life of the affected individual," keep the $5 million insurance floor, and let agencies reimburse employees for privacy tools like data-broker removal services.

Here is the honest read. The bill has zero Republican cosponsors in either chamber. Republicans control both. No markup is scheduled, and a similar 2024 bill died without a vote. The only realistic path before September 30 is attachment to a must-pass spending vehicle, which would require Republican leadership to agree. Track it at congress.gov, but execute the checklist as if the deadline holds.

Know What Your Federal Benefits Are Worth

The $5 million insurance you are losing was a real, if invisible, piece of your compensation. Use our free Federal Total Compensation Calculator to see the full dollar value of the benefits you still have, from FEHB to TSP matching.

Frequently Asked Questions

Did the OPM data breach affect me?

If you were a federal employee, retiree, or contractor, or applied for a security clearance before 2015, you were probably affected. Spouses and co-habitants listed on SF-86 forms were too. Check opm.myidcare.com for an account.

When exactly does my coverage expire?

On the 10th anniversary of your enrollment, with a hard program end of September 30, 2026. Early enrollees may have lapsed already. Your account page shows your date.

What can't I replace for free?

The restoration specialist and the $5 million insurance. Monitoring, freezes, alerts, and reports all have free equivalents under permanent federal law.

Will Congress extend the coverage in time?

Unlikely on the current trajectory. No Republican cosponsors, no scheduled markup, and 7 weeks to the deadline. Act as if it ends on schedule.

What single step matters most?

The credit freeze. It is free at all three bureaus, takes 30 minutes total, and blocks most new-account fraud outright, which monitoring never did.

Sources