Hackers who stole security clearance data on millions of Defense Department and other U.S. government employees got away with about 5.6 million fingerprint records, some 4.5 million more than initially reported, the government said on Wednesday.

During an ongoing analysis of the data breach, the estimated number of people who had fingerprint records stolen rose from 1.1 million to about 5.6 million, the Office of Personnel Management said in a statement.

OPM has estimated a total of 21.5 million people had their Social Security identification numbers and other sensitive information stolen in the hacking incident earlier this spring. The discovery of additional missing fingerprints did not affect that overall total, it said.

U.S. officials have privately blamed the breach on Chinese government hackers, but they have avoided saying so publicly. Officials also have said no evidence has surfaced yet suggesting the stolen data has been abused, though they fear the theft could present counterintelligence problems.

OPM said in its statement the discovery of additional stolen fingerprints came as officials from OPM and the Defense Department were analyzing data affected by the incident.

During that process, officials “identified archived records containing additional fingerprint data not previously analyzed,” increasing the estimated number of people who had fingerprint data stolen, the OPM statement said.

OPM downplayed the danger of stolen fingerprint records, saying the ability to misuse the data is currently limited. But it acknowledged the threat could increase over time as technology evolves.

“Therefore, an interagency working group with expertise in this area … will review the potential ways adversaries could misuse fingerprint data now and in the future,” it said.

The group includes members of the intelligence community as well as the FBI, Department of Homeland Security and the Pentagon.

“If, in the future, new means are developed to misuse the fingerprint data, the government will provide additional information to individuals whose fingerprints may have been stolen in this breach,” OPM said.

The Defense Department and OPM are working together to begin mailing notifications to the people whose information was stolen, the OPM statement said.

(Reporting by David Alexander; Editing by Susan Heavey and Andrew Hay)

This article originally appeared on Recode.net.

A deal easing the transfer of data between the United States and the EU is invalid, an adviser to the European Union’s top court said on Wednesday, dealing a blow to a system used by Facebook, Google and thousands of other companies.

The Safe Harbor agreement did not do enough to protect EU citizen’s private information when it reached the United States and should have been suspended, Yves Bot, advocate general at the European Court of Justice (ECJ), said.

While Bot’s opinions are not binding, they tend to be followed by the court’s judges, who are considering a complaint about the system in the wake of revelations from ex-National Security Agency contractor Edward Snowden of mass U.S. government surveillance.

In a trenchant legal opinion which will do little to heal frayed transatlantic relations following the spying leaks, Bot also said national data protection authorities could suspend data transfers to third countries if they felt EU citizens’ privacy was compromised.

That would cause a headache for U.S. companies operating in the EU as well as open up the risk of a patchwork of national approaches, lawyers said.

Many companies, particularly tech companies, have hailed the 2000 Safe Harbor deal, saying it helps them get around cumbersome checks to transfer vital data, including payroll and human resources information as well as online advertising worth billions of dollars, between offices on both sides of the Atlantic.

“We are concerned about the potential disruption to international data flows if the court follows today’s opinion,” said John Higgins, director general of DigitalEurope, whose members include Apple, Cisco, Ericsson and Google.

Lawyers said a negative ruling from the court would have an impact on all data transfers between the EU and the United States, not just those conducted through Safe Harbor.

“If you question overall the validity of U.S. law, then what about these other legal mechanisms?” said Wim Nauwelaerts, partner at law firm Hunton & Williams.

That could lead to calls from privacy advocates for more data centers in Europe, something the industry has long resisted on the grounds that it constitutes protectionism.

Some European companies, however, such as Germany’s Deutsche Telekom, have said they would route all email traffic through domestic servers to avoid U.S. snooping.

The case stems from a complaint filed by 27-year-old Austrian law student Max Schrems against Facebook, alleging the company was helping the U.S. National Security Agency (NSA) harvest email and other private data by forwarding European customer’s data to servers in the United States.

Facebook rejects the claim that it provided the NSA with “backdoor” access to its servers and said it would wait for the full judgment, a spokeswoman said on Wednesday.

The Irish Data Protection Commissioner, who watches over major tech companies’ compliance with privacy laws since they are headquartered in Ireland, rejected the complaint, saying such transfers were allowed under the Safe Harbor framework.

But the case was referred to the European Court of Justice after Schrems appealed.

“It is apparent from the findings of the High Court of Ireland and of the (European) Commission itself that the law and practice of the United States allow the large-scale collection of the personal data of citizens of the EU which is transferred, without those citizens benefiting from effective judicial protection,” Bot said.

The United States and the commission have been in talks for two years to strengthen the Safe Harbor framework amid calls for its suspension.

Herwig Hofmann, a lawyer for Max Schrems, said he was “delighted” about the advocate general’s opinion.

“If the United States doesn’t change its laws in order to guarantee a minimum of data protection to European citizens, U.S. companies will have to process their data in the EU,” he told reporters at the court in Luxembourg.

(Additional reporting by Pia Oppel in Luxembourg; Editing by Andrew Heavens and David Evans)

This article originally appeared on Recode.net.

Citrix Systems, the cloud computing company targeted by activist hedge fund Elliott Management, is making a final attempt to sell itself as a whole before it embarks on asset sales, according to people familiar with the matter.

Citrix, which had attracted the interest of private equity investors before it agreed in July to give Elliott a seat on its board of directors, is having new conversations with buyout firms, the people said this week.

The company, which has a market capitalization of $11.6 billion, has also reached out to other technology firms to solicit interest, including Dell, the computer maker that was taken private two years ago by its founder, Michael Dell, and private equity firm Silver Lake Partners, the people added.

Citrix announced in July it would explore strategic alternatives for its GoTo family of products, including videoconferencing and desktop sharing service GoToMeeting. However, a sale process for these assets has not started yet because Citrix wants to see if it can still sell itself at a satisfactory valuation, according to the sources.

If Citrix does not sell itself in its entirety, it will not just seek to sell or spin off its GoTo products, but it will also explore options for other assets down the line, according to the sources.

The sources asked not to be identified because the deliberations are confidential. Citrix, Dell and Silver Lake declined to comment.

Based in Santa Clara, Calif., Citrix provides communications software and networking solutions for businesses. It reported net income of $251.7 million in 2014, down from $339.5 million in 2013.

Earlier this year, Elliott called on Citrix to sell some units, cut costs and buy back shares to make up for six years of underperformance. In addition to the GoTo business, Elliott has called for Citrix to explore the sale of NetScaler, which helps speed up Web-based applications.

Elliott clinched a deal with Citrix in July that gave Jesse Cohn, one of its senior partners, a seat on the company’s board. Citrix also said it would start a search for an independent board member, mutually agreeable to Citrix and Elliott.

It also said at the time that Chief Executive Mark Templeton was retiring and that it would search for a new CEO.

Earlier this month, Citrix said it would repurchase up to an additional $500 million of its common stock.

(Reporting by Liana B. Baker and Greg Roumeliotis in New York; Editing by Alan Crosby)

This article originally appeared on Recode.net.

French data privacy regulators took a step towards sanctioning Google by rejecting the company’s request to drop a case against it for refusing to clean up information from its search engine results.

Under Europe’s so-called right to be forgotten, individuals can ask search engines such as Google and Microsoft’s Bing to remove information that appears under a search of their name if it is incorrect, out of date, irrelevant or inflammatory.

Since the European Court of Justice ruling last year that granted this right to European residents, Google has fielded nearly 320,000 requests, granting about 40 percent of them. But it only de-lists the links on European versions of its sites, such as Google.fr or Google.de, not globally, meaning the information remains available.

The French authority, the CNIL, in June ordered Google to de-list, on request, search results appearing under a person’s name from all its websites, including Google.com.

The company refused in July and requested that the CNIL abandon its efforts, which the regulator officially refused to do on Monday.

“The President of the CNIL rejects Google’s informal appeal against the formal notice requesting it to apply delisting on all of the search engine’s domain names,” the watchdog said.

France is the first European country to open a legal process to punish Google for not applying the right to be forgotten globally.

But an umbrella group of European data protection watchdogs took a similar position in December on the issue of cleaning up search results globally, saying that it was the only way to ensure the “effective and complete protection of data subjects’ rights and that EU law cannot be circumvented.”

A CNIL spokesman said Google was required to comply immediately and begin de-listing information about French residents from all of its sites.

If it refused, the CNIL will spend the next two months preparing sanctions that can include up to 150,000 euro ($169,000) in fines, climbing to 300,000 euro for repeat offenses.

Google said it had worked hard to implement the right to be forgotten ruling “thoughtfully and comprehensively in Europe” and would continue to do so.

“But as a matter of principle, we respectfully disagree with the idea that a single national Data Protection Authority should determine which webpages people in other countries can access via search engines,” said a spokesman for the company.

In July, Peter Fleischer, Google’s global privacy counsel, called France’s request to clean up global results “troubling” and said it could risk “serious chilling effects on the web.”

“While the right to be forgotten may now be the law in Europe, it is not the law globally,” Fleischer wrote.

($1 = 0.8870 euros)

(Additional reporting by Julia Fioretti in Brussels; Editing by Keith Weir)

This article originally appeared on Recode.net.

German chip maker Dialog Semiconductor has agreed to buy U.S. rival Atmel for about $4.6 billion, amid a wave of dealmaking in the sector as firms seek alternatives to saturated mobile phone markets.

Dialog, which is heavily exposed to Apple and Samsung, said the deal would diversify its client base in automotive markets as well as network-connected chips used in industrial gear, the so-called Internet of Things.

Worldwide semiconductor mergers and acquisitions reached $31 billion in 2014, the most since 2011, according to Thomson Reuters data, and the pace has not let up this year.

Through acquisitions, chip makers are looking to gain share of solid markets such as industrial and automotive, where there is growing demand to make products “smart” by adding Internet connections.

“By bringing together our technologies, world-class talent and broad distribution channels we will create a new, powerful force in the semiconductor space,” Jalal Bagherli, Dialog’s chief executive, said in a statement.

Major deals have included Infineon’s $3 billion purchase of U.S. peer International Rectifier last year as well as NXP’s announcement in March that it would acquire U.S. peer Freescale Semiconductor, valuing the combined group at more than $40 billion.

Dialog said Sunday that Atmel shareholders would receive $4.65 in cash and 0.112 of a Dialog Semiconductor American Depository Share for each Atmel common share, equivalent to $10.42 per Atmel share based on Dialog’s closing price as of Sept. 18.

This represents a 43-percent premium over Atmel’s closing price of $7.27 on Friday.

Dialog said it planned to pay for the deal via cash, $2.1 billion of debt and about 49 million Dialog American Depository Shares. Following the transaction, Atmel shareholders will own about 38 percent of the combined group, Dialog said.

The transaction, expected to close during the first quarter of 2016, will boost Dialog’s earnings in 2017, Dialog said, and result in annual cost savings of $150 million within two years.

(Addditional reporting by Harro ten Wolde and Eric Auchard; Editing by Andrew Roche)

This article originally appeared on Recode.net.