Identity Theft Guard Solutions LLC, operating as ID Expertsbased in Portland, Oregon, was awarded a $133.3 million contract to help 21.5 million employees affected by the massive hack of Office of Personnel Management (OPM) records revealed in June, which many are blaming on Chinese hackers. Exercising all options would bring the total value to $329.8 million.

“Data breach recovery services include credit and identity monitoring services, identity theft insurance, identity restoration services, as well as website services and call center services,” said the Department of Defense contract announcement. “These services will be offered to individuals impacted by the OPM background investigation records cyber incident.”

The contract is scheduled to be completed by December 2018. Naval Sea Systems Command issued the contract.

On the same day that Homeland Security Secretary Jeh Johnson said the OPM breach was a wake-up call and called on the House Judiciary Committee to specifically fund the EINSTEIN cybersecurity system for federal agencies, at least two members of Congress said they plan to investigate the OPM breach and government cybersecurity writ large.

Given that part of the OPM breach involved a database with security clearance-related information, many of the stolen records belonged to Defense Department employees and members of the military. That’s particularly troubling to Rep. Mac Thornberry, who on July 14 pledged the House Armed Services Committee, which he chairs, will in the coming weeks investigate how the breach could impact national security and military operations.

“We have an obligation to ensure that those who serve the department, in or out of uniform, are able to do so securely,” he said in a statement, according to Military Times. Thornberry also said he plans to investigate “larger questions of cyber defense and the security clearance process.”

The results of those investigations could mean serious consequences for leaders failing to uphold IT security at their agencies.

“The recent OPM hack and the departure of Director [Katherine] Archuleta is, I think, a good thing – because guess what? Every agency head and CIO should be pulling out their [inspector general] report on their digital infrastructure, because we’re going to start calling them before our committee and asking them the same questions,” said Rep. Will Hurd (R-Texas), chairman of the House Committee on Oversight and Government Reform’s IT subcommittee. “We’re going to make sure we don’t see what happened at OPM happen again at other agencies. Now, the example is set: Major breaches are bad things and you’re going to lose your job. That’s great motivation within the federal government.”

Hurd spoke July 14 in Washington at an event held by Digital Globe and Cloudera.

As the congressional inquiries into OPM and federal IT security begin, at least some questions will center on the government’s procurement, use and management of IT systems – or their lack thereof.

“Agencies are buying software that have security functions, and they’re disabling them. That’s outrageous. In the design of digital infrastructure, they’re not using secure practices,” Hurd said. “The IRS is talking about moving from a relatively [21^st]-century system back to mainframes. They literally are trying to move data back to mainframes. That’s insane. So a lot of this is tied up in how the federal government is purchasing IT goods and services…we’re trying to shine a light on that.”

Hurd said that his subcommittee plans to roll out a system that will measure federal agencies’ adherence to IT security rules and standards.

“We’re coming up a scorecard that we’ll be using against agencies on whether they’re following basic practices in digital hygiene and cybersecurity,” he said.

No active-duty service members would have data among the compromised records unless they have prior federal civilian employment, an OPM spokesman told Military Times. However, for troops that fall into that category, especially those with security clearances, the risk could be significant.

A foreign government, for example, might find information in stolen clearance questionnaires that could be used to blackmail clearance holders, speculated Paul Rosenzweig, founder of the homeland security consulting company Red Branch consulting and a senior adviser to The Chertoff Group.

“All your overseas deployments, who you know, how you spend your money, prior bad acts, embarrassments ranging from affairs to drug use,” said Rosenzweig, listing information he believed might come to light through the data breach. “… I hold a security clearance myself and I’ve been sitting here thinking of a half-dozen things I haven’t told my wife.”

Andrew Borene, a cybersecurity expert with the Truman National Security Project and a former Marine intelligence officer, disagreed that the data is likely to yield effective blackmail material, but fraud against service members is a real risk.

Read the full report at MilitaryTimes.com.

U.S. officials quickly identified China as a possible source of the attack, a charge that China quickly criticized.

The cyber attack on OPM – or more specifically, on Interior Department data centers that house OPM data –occurred despite government-wide cybersecurity efforts led by the Homeland Security Department that include continuous diagnostic monitoring and the $3 billion Einstein network monitoring program.

For its part, DHS leadership said they helped OPM “develop and implement a comprehensive network monitoring plan” that led to OPM identifying the breach in April. That plan included Einstein, according to a DHS statement.

“Using these newly identified cyber indicators, DHS’s United States-Computer Emergency Readiness Team (US-CERT) used the Einstein system to discover a potential compromise of federal [personal identifiable information]. Working with the affected agency and other interagency partners, US-CERT cyber incident response teams were deployed to identify the scope of the potential intrusion and mitigate any risks identified,” a DHS spokesman said in an emailed statement.

Related: OPM hack could affect 4 million people

According to a DHS official speaking on background, US-CERT reviewed the malware and shared the analysis with the affected agencies and interagency partners, and deployed the signatures to Einstein to protect federal networks. DHS then shared the data with all federal CIOs, and US-CERT also worked with the FBI to disseminate an information bulletin about the malware to the private sector and other cybersecurity stakeholders.

“In this incident, Einstein was used to identify the presence of a cybersecurity incident affecting OPM’s IT systems and data at the Department of the Interior’s data center, which is a shared service center and a means for federal agencies to collaborate and achieve efficiencies,” the official said.

But there are a few different iterations of the Einstein, each more comprehensive than the other, and it’s unclear what agencies do or do not have Einstein in place on their networks – especially the latest version, Einstein 3 (Accelerated) or E3A. All three versions of Einstein are designed to detect and repel malicious traffic on federal networks, and are provided as managed services by internet service providers under DHS direction.

Related: Intel leaders fault OPM over massive cyber breach

Einstein 3 is scheduled to be deployed across federal networks next year, an acceleration on the original 2018 schedule, Josh Earnest, White House press secretary, said in a June 5 press conference.

But Einstein’s application is uneven across the government for a variety of reasons.

The Department of Interior contracts at least some of its telecommunications services through the Networx contract, provided by Century Link, Verizon and AT&T. Century Link and Verizon reportedly both provide Einstein to federal agencies under a signed agreement, but AT&T refused the agreement without liability protections, according to a former DHS official.

“It’s not clear if they ever did sign. [DHS] was trying to find a way to bring AT&T onboard, but if they didn’t, only CenturyLink and Verizon traffic would have been filtered through the additional signature checks protected by Einstein,” said Chris Cummiskey, former DHS acting undersecretary for management.

AT&T provides at least some of Interior’s telecom services, according to public records, but it is unclear if those services cover the agency’s data centers. AT&T did not respond to requests for comment.

Where Einstein is implemented isn’t the only question the OPM breach raises.

“Einstein should have … detected this, but it also should have protected the exfiltration from happening. Why did it detect the intrusion but not protect against infiltration?” said Mark Weatherford, former DHS deputy under secretary for cybersecurity and now Chertoff Group principal. “The whole secret sauce of Einstein is taking government intelligence and information and applying it in addition to commercially available intelligence and information. It’s supposed to be the bar for government agencies to be able to detect and mitigate better than pure commercial products? So how did this happen? Why did Einstein and other commercial products not notice all this information being transmitted to a foreign country’s IP range?”

It’s a question that is likely to echo in the coming weeks as the fallout from the OPM breach continues. Backers of Einstein insist it’s critical to federal cybersecurity – and that it works – but the program is likely to face serious scrutiny.

“The government has spent hundreds of millions on this; there are committees on the Hill that are invested in and committed to this. So it’s a legitimate question to ask if Einstein couldn’t prevent this breach, is it worth the hundreds of millions we’re putting into it? What is the problem?” Weatherford said.

As many as 4 million current and former federal employees may have had their personally identifiable information compromised in a breach of IT systems at the Office of Personnel Management.

Sen. Richard Burr, R-N.D., the chairman of the Senate Select Committee on Intelligence, said that the breach at OPM demonstrates that cybersecurity must be a top priority.

He said every day cyber attacks are getting more technically advanced and that the government cannot continue to look the other way.

” Our response to these attacks can no longer simply be notifying people after their personal information has been stolen; we must start to prevent these breaches in the first place,” Burr said.

Sen. Mark Warner, D-Va., a ranking member of the Senate Select Committee on Intelligence, faulted OPM for its inability to protect the personal information of federal employees.

“Today’s reported breach is part of a troubling pattern by this agency in failing to secure the personal data of federal employees – the second major breach in a year,” Warner said. “We cannot afford to keep dragging our feet in addressing the escalating threats posed by hackers out to steal individuals’ personal information.”

See also: OPM hack could affect 4 million people

Warner has also included language in the bipartisan Cybersecurity Information Sharing Act that would require the intelligence community to produce a comprehensive accounting of cyber threats and cyber crime, as well as new technologies that could help with detecting and reporting breaches.

Warner is also preparing to introduce data breach legislation that would create a comprehensive, nationwide and uniform data breach standard requiring timely consumer notification for breaches of financial data and other sensitive information.

OPM has said it will notify approximately 4 million individuals whose information may have been stolen, according to the announcement. Because the incident is still under investigation, more individuals whose information is at risk may yet be identified.

OPM will also offer credit report access and credit monitoring to the potentially affected people.

Sen. Ron Johnson, R-Wisc., the chairman of the Senate Homeland Security and Governmental Affairs Committee, said it was disturbing that hackers from China may have sensitive information about current and former federal employees.

“It is even more troubling that this is only the latest in a series of cyberattacks on the Office of Personnel Management,” Johnson said.

Despite OPM statements that it has undertaken an aggressive effort to update its security posture “Plainly, it must do a better job, especially given the sensitive nature of the information it holds,” Johnson said.

Rep. Steny Hoyer, D-Md., House democratic Whip, said he was deeply concerned about the OPM data breach and that federal employee information must be better protected.

“We must do everything we can to defend against cyber threats both in government and in the private sector,” Hoyer said.

J. David Cox, the President of the American Federation of Government Employees, said that the union was working closely with the administration to determine the extent of the breach and ways to remediate it.

“AFGE will demand accountability and will take every necessary step to see that the interests and security of the nearly 700,000 people we represent are addressed,” Cox said.