It wasn't a hack. It was complete incompetence. A contractor had full access, for a very long time, to the data and they just took it.

Since it involves your SF-86 it impacts everybody you listed; spouse, children, siblings, parents, etc. So when they say 21.8 million records, multiply that by a factor of 3-5 to fully understand the level of this breach.