Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political cap

Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...