WASHINGTON — U.S. Sen. Mark Warner, D-Va., and Del. Eleanor Holmes Norton, D-D.C., have introduced legislation that would provide lifetime identity protection services to millions of current and former federal employees whose personal information was compromised in the 2015 cyberattack on the Office of Personnel Management.

The Reducing the Effects of the Cyberattack on OPM Victims Enduring Response and Protecting Identifiable Information (RECOVER PII) Act would extend identity protection benefits that are scheduled to expire Sept. 30. The bill would also reimburse affected federal employees and contractors for eligible privacy software and other tools designed to remove or reduce their personal information online.

Warner said the threat posed by the stolen data has not diminished, even more than a decade after the breach.

“More than ten years after the OPM data breach exposed the personal information of millions of federal employees, the threat remains,” Warner said in a statement. “We have a responsibility to stand by the federal workers who were put at risk through no fault of their own.”

Norton said lifetime protections are necessary because personal information stolen in cyberattacks can remain valuable to criminals and foreign intelligence services indefinitely.

“Lifetime identity protection is the only solution that will give the workers whose data was compromised the peace of mind they deserve,” Norton said.

The legislation is co-sponsored by Sens. Tim Kaine, D-Va., Angela Alsobrooks, D-Md., and Chris Van Hollen, D-Md., as well as Reps. Don Beyer, D-Va., and Steny Hoyer, D-Md.

The 2015 breach is considered one of the most damaging cyber intrusions in U.S. government history. Hackers accessed sensitive records affecting roughly 22.1 million people, including federal employees, contractors, military personnel, job applicants and others who underwent government background investigations. Exposed information included Social Security numbers, addresses, financial records, fingerprints and detailed security clearance and background investigation files.

U.S. officials have long attributed the attack to hackers linked to the Chinese government, though Beijing has denied responsibility.

Current law provides victims with 10 years of government-funded identity protection services, a benefit Congress approved in 2017 after Warner and others pushed for additional safeguards. Those protections are set to expire later this year unless Congress acts.

Supporters of the legislation argue that unlike financial data, security clearance records and other personal information stolen in the breach cannot be changed and could remain useful to foreign intelligence agencies for decades. They say extending identity monitoring and privacy services is a relatively modest investment compared with the potential costs of identity theft and espionage.

Some fiscal conservatives have questioned whether the federal government should commit to paying for lifetime identity protection, arguing that Congress should better define the program’s long-term costs and effectiveness before creating a permanent benefit. Others have said agencies should focus more heavily on preventing future cyber intrusions than extending post-breach services.

Cybersecurity experts generally agree that the OPM breach remains a unique case because of the breadth and sensitivity of the information stolen. Unlike a typical commercial data breach involving credit card numbers, the OPM files included comprehensive background investigation records that can be used for intelligence gathering, recruitment or blackmail, making the risks difficult to eliminate even years later.

The bill has been referred to committee, where it will require approval before advancing to the full House and Senate. With the current identity protection program expiring Sept. 30, lawmakers have a limited window to extend benefits before coverage lapses.