The Office of Personnel Management (OPM) announced that 5.6 million fingerprints were stolen in April’s cyber attack, more than five times the amount the agency first reported.

The hackers were able to obtain fingerprints, social security numbers, names, addresses, health information, and financial data from millions of government employees. The OPM stated in June that personnel records of 4.2 million people had been compromised in the cyber attack. A month later, the agency announced a second attack that was targeting 21.5 million people and only 1.1 million fingerprints had been stolen.

“The fact that the number [of fingerprints breached] just increased by a factor of five is pretty mind-boggling,” said Joseph Lorenzo Hall, the chief technologist at the Center for Democracy & Technology. “I’m surprised they didn’t have structures in place to determine the number of fingerprints compromised earlier during the investigation.”

The OPM tried to downplay the situation by stating that the ability to abuse fingerprint data was “currently limited.” The agency did warn that as technology improved there could be a higher chance of someone using their fingerprints as a guarantee of identity. Considering there are now security measures for unlocking smartphones and home security systems using a person’s fingerprints, that day may not be as far as the OPM states.

Investigations are continuing as officials are still trying to find who was responsible for the cyber attacks. Meanwhile, the OPM is still in the process of notifying everyone who had information stolen. According to the agency, they will provide free identity theft and fraud protection services to those who were affected by the cyber attack.

U.S. officials have blamed China for the OPM breach. China has continued to deny the attacks. The announcement comes during the second day that Chinese President Xi Jinping is visiting the United States. Jinping is due to meet President Obama in Washington on Friday.