OPM Breach Identity Protection Is Ending: Best Alternatives for 2026

The federally funded identity protection from the 2015 OPM breaches ends no later than September 30, 2026, leaving roughly 22.1 million people to arrange their own cover. Our top pick to replace it is PrivacyOn, which removes your exposed data from 100+ brokers from $8.33/month — here is how it compares to renewing MyIDCare.

What Is Ending, and When

After the two 2015 breaches at the Office of Personnel Management, Congress funded ten years of identity protection for those affected under the Consolidated Appropriations Act. That clock has now run out.

• The scale: one breach exposed personnel records for about 4.2 million people; a second exposed roughly 21.5 million background-investigation records. About 3.6 million people were caught in both, for a combined total of around 22.1 million.
• The service: coverage has been administered through MyIDCare, run by ID Experts (IDX).
• The deadline: coverage is expiring on a rolling basis as each enrollee reaches ten years from their own enrollment date. Notices began going out in late 2025, and everything ends no later than September 30, 2026.

In August 2026 lawmakers proposed extending identity protection to 2015 OPM breach victims for life. That is a proposal, not law — plan as though nothing passes, because your coverage lapses on schedule either way.

Step 1: Check Your Own Expiration Date

Do not assume. Log in at opm.myidcare.com and confirm the expiration date on your account. Because the wind-down is keyed to individual enrollment dates, some people lost coverage months ago while others are still inside the window. If your coverage has lapsed or is about to, you will be offered the chance to renew at your own cost.

Quick Verdict: What to Replace It With

• Best overall — PrivacyOn (our top pick): removes your personal data from 100+ data brokers and people-search sites, monitors 24/7 for re-listings, includes dark web monitoring, and covers up to 5 family members from $8.33/month. It attacks the exposure itself rather than just watching for fallout.
• Free and essential, whatever else you do: a credit freeze at all three bureaus, plus your free weekly credit reports.
• Renewing MyIDCare/IDX: familiar and continuous, but you now pay retail for monitoring-led coverage — see our IDX review.
• Bundled insurance plays: LifeLock, Aura and Identity Guard lead with restoration support and identity theft insurance.

Why PrivacyOn Is Our Top Pick for OPM Breach Victims

The distinctive problem for this group is not a leaked password — it is that background-investigation records are extraordinarily rich. Addresses going back years, relatives, former employers, financial history, and in millions of cases fingerprints. That data does not expire, and it has had a decade to circulate.

Monitoring services tell you after something has already been opened in your name. PrivacyOn reduces what an attacker can find in the first place, which is the more useful lever when the underlying leak is a decade old and permanent:

• 100+ brokers and people-search sites — the sites that publish your current address, phone number, and relatives, which is exactly what turns an old background file into a usable profile today.
• 24/7 re-listing monitoring — brokers rebuild from public records, so one-time removal does not hold.
• Dark web monitoring included, so you still get the alerting side.
• Family plans up to 5 people — OPM background records named spouses, relatives and cohabitants, so household coverage is not a nice-to-have here.
• From $8.33/month, generally below what a retail MyIDCare renewal or a premium identity-theft plan costs.

Step 2: Do the Free Things First

No subscription, including ours, substitutes for these:

1. Freeze your credit at Equifax, Experian and TransUnion. It is free, permanent until you lift it, and it is the single most effective block on new-account fraud.
2. Pull your free credit reports at annualcreditreport.com.
3. Add an IRS Identity Protection PIN to stop fraudulent tax filings.
4. Turn on multi-factor authentication everywhere, preferring an app or hardware key over SMS.

Credit freezes and free reports do not depend on Congress passing anything. Do them this week, then layer PrivacyOn on top to shrink the exposure that made you a target.

The Options, Compared

1. PrivacyOn — best overall value

Data broker removal across 100+ sites, 24/7 monitoring, dark web monitoring, family plans for up to 5, from $8.33/month. Best for anyone who accepts that the 2015 data is gone for good and wants to cut what can be built from it now. Our recommendation for the large majority of affected feds and contractors.

2. MyIDCare / IDX renewal

The incumbent. Renewal means no gap in coverage and a familiar portal, and IDX is a credible vendor — it held a federal contract for a decade. The trade-off is that you are now paying retail for a monitoring-and-restoration product, and broker removal is not its centre of gravity. See PrivacyOn vs IDX for the detail. Reasonable if continuity matters most to you; PrivacyOn covers more ground per dollar.

3. LifeLock, Aura and Identity Guard

These lead on identity theft insurance and hands-on restoration, and all three are legitimate. If your priority is a large insurance figure and a caseworker after a fraud event, they are worth pricing — see our 2026 identity theft protection comparison. Note that their headline prices usually rise sharply after the first year, and their broker-removal coverage is narrower than a dedicated removal service. For most OPM victims, PrivacyOn delivers more of what actually matters here, for less.

4. Nothing at all

With frozen credit and good MFA you are not defenceless. But the OPM data is permanent, detailed, and already traded, and leaving your current address and phone number published on 100+ people-search sites keeps the door open to targeted phishing and impersonation. At $8.33/month, closing it is the cheap part.

Which Should You Choose?

• Most affected feds and contractors: PrivacyOn, plus free credit freezes. Best coverage per dollar and it targets the actual exposure.
• You want zero gap and one familiar login: renew MyIDCare, and still run PrivacyOn for the broker removal it does not do.
• You have already had fraud committed in your name: pair a restoration-heavy plan with PrivacyOn, so you are cleaning up and shutting off the supply at once.
• Your household was named in a background file: PrivacyOn's family plan for up to 5 people is the most economical way to cover everyone.

The Bottom Line

Ten years of government-funded cover ends by September 30, 2026, and nothing replaces it automatically. Freeze your credit today — it is free and it is the strongest single control you have. Then replace the subscription with PrivacyOn: 100+ data brokers removed, 24/7 re-listing monitoring, dark web monitoring, and up to 5 family members covered from $8.33/month. It is the best overall value of the options here, and it works on the part of the problem that a decade of monitoring never touched. Start with a free scan to see what is exposed under your name right now.

Frequently Asked Questions

When exactly does OPM breach identity protection end?

No later than September 30, 2026. Coverage expires on a rolling basis as each person reaches ten years from their individual enrollment date, so yours may already have lapsed. Log in at opm.myidcare.com to check your own expiration date rather than assuming you have until the deadline.

Is there a better alternative to renewing MyIDCare?

For most people, yes — PrivacyOn. A paid MyIDCare renewal continues monitoring you for fallout; PrivacyOn reduces the exposure itself by removing your name, address, phone number and relatives from 100+ data brokers and people-search sites, monitoring 24/7 for re-listings, and including dark web monitoring. It covers up to 5 family members from $8.33/month, which is typically less than a retail renewal. Start with a free scan, and keep the free credit freezes either way.

Will Congress extend the OPM identity protection?

A bill proposed in August 2026 would give 2015 OPM breach victims identity protection for life, but it has not become law. Plan on the basis that coverage ends on schedule; if an extension passes later, you will have lost nothing by freezing your credit and removing your broker listings in the meantime.

I was in the OPM breach. Is my data still dangerous after ten years?

Yes. Background-investigation records included addresses, relatives, former employers, financial details and, for millions of people, fingerprints. None of that can be reissued like a password. The practical defence is to limit what can be added to it today — which means removing the current address and phone data that data brokers publish about you.

Do I still need a credit freeze if I pay for a service?

Yes. A credit freeze is free, permanent until you lift it, and blocks new-account fraud more effectively than any paid monitoring product. Freeze all three bureaus first, then add a service for the exposure a freeze cannot touch.

What is the cheapest way to stay protected after coverage ends?

Free credit freezes at all three bureaus, an IRS Identity Protection PIN, and multi-factor authentication cost nothing. On top of that, PrivacyOn at $8.33/month is the least expensive way to get 100+ broker removals, 24/7 monitoring, dark web monitoring and family coverage for up to 5 people in one place.