But the vast majority of the more than 20 million affected people still have not been officially notified that their information was exposed, leaving them nervous and fearful of what might lie ahead. And it may be weeks before the federal government is in a position to do anything to protect them, according to industry officials frustrated with what they say are inexcusable delays.

“People are really nervous,” said Stan Soloway, president of the Professional Services Council, an industry group that represents government contractors. “They’ve been waiting for that next shoe to drop, wondering, ‘Am I affected? What coverage do I have?’ And now we’re looking at six to eight weeks to find out what’s been compromised and what hasn’t. This is sensitive stuff.”

In a letter this week to Beth Cobert, acting director of the Office of Personnel Management, Soloway wrote that “it has now been more than four weeks since the first public release of the” breach, and the “estimated 21.5 million employees and their family members are not sure of their exposure.”