Last year's massive hack of the US Office of Personnel Management's security clearance system affected 21.5 million people, including 1.8 million people who didn't apply for a background investigation, officials said Thursday, making it official the breach was the worst in US government history.

The new figure includes most, if not all, of the 4.2 million people the agency previously said were exposed in a separate breach of personnel files. The much larger number resulted from the hack in June or July of last year on the system used to conduct background checks on contractors and other private sector employees, as well as federal workers. Some 1.1 million of the stolen records included applicants' fingerprints. Background checks for people applying with the Central Intelligence Agency weren't affected because that agency conducts its own security clearance investigations.

"If you underwent a background investigation through OPM in 2000 or afterwards (which occurs through the submission of forms SF-86, SF-85, or SF-85P for either a new investigation or a reinvestigation), it is highly likely that you are impacted by the incident involving background investigations," OPM officials warned in an update published Thursday. "If you underwent a background investigation prior to 2000, you still may be impacted, but it is less likely."

The details on the background investigation forms are a data bonanza for hackers. They include social security numbers, residences, mental health histories, and other highly personal details not only for applicants but also for applicants' family members. National security experts have warned the data can be mined to identify US intelligence operatives.

At a Senate Intelligence Committee hearing Wednesday, FBI Director James Comey said he and his family were personally affected by the breach, The Washington Post and other publications reported.

"I'm sure the adversary has my SF86 now,” he said, referring to the Standard Form 86 that applicants for security clearances fill out, according to The Washington Post. He said the form listed "every place I’ve lived since I was 18, every foreign trip I've taken, all of my family and their addresses… I’ve got siblings. I’ve got five kids. All of that is in there."

The lapses that led to the OPM hack are breathtaking, as Ars recently chronicled here and here. The magnitude of those shortcomings are outdone only by the significance of the loss not only to US national security but also to the individual applicants and their families. To steal a line from a recent episode of the HBO sitcom Veep: "That's not just a breach. That's a data rupture!"