At least $36 billion in fraudulent unemployment benefits have been stolen from the U.S., according to analysis from the Office of the Inspector General for the Department of Labor.

As CNBC reports, 10 percent of the $360 billion Congress allotted for unemployment benefits in the Cares Act have been improperly distributed, mostly due to scams that have taken those benefits away from unemployed workers. The fraud has prompted several states, including California, to freeze benefits as they implement changes to combat the theft.

“This is the largest fraud attack on the U.S. ever. Period,” Blake Hall of ID.me, a company that provides identity-verification to state unemployment agencies, told CNBC. “And it’s not even close.”

Hackers and others took advantage of state unemployment systems’ lax security measures. In response, the new COVID-19 relief package signed in December includes measures to prevent theft of future unemployment benefits. 

The fraud primarily took place under the Pandemic Unemployment Assistance program for self-employed and gig workers, an expansion in the CARES Act that covered workers the are usually ineligible for unemployment benefits. In some states, more than 35 percent of PUA applications were fraudulent.

Most of the fraudulent applications were the result of identity theft, thanks to the fact that states required very little more than a name, birth date, and social security number to apply. The Department of Labor is tying some of the theft to hackers in China, Nigeria, and Russia. USA Today spoke with one student alone who made about $50,000 siphoning off the benefits using hacked information he bought online. 

“Once we have that information, it’s over,” the engineering student told USA Today. “It’s easy money.” 

However, some now fear the new requirements to tighten security and protect against fraud could delay benefits to Americans who need them now more than ever. 

"It's a little bit of a high wire act," Bill McCamley, Cabinet secretary of the New Mexico Department of Workforce Solutions, told CNBC. "Because there's so much pressure to get money out."