My GF just hit me up and told me she just sent some of her personal info over an email. She was trying to send her folks some documents.I guess the documents had some sensitive info on them Like her full name, SSN#, etc. The email was not encrypted. How at risk is she and what should she do from here? She is freaking out.
Most of the people who are in power to eavesdrop on the email, like the internet service providers and email providers of her and her recipient and the three letter agencies, are likely not very interested in that information. Providers are in a position to collect lots of sensitive information, but they can not risk to abuse it, because it would be quite a public relation disaster for them when it would become public (besides, in many jurisdictions it would be against the law). Government entities already have all that information anyway, so unless she is also involved in some criminal activity she should be fine.
It should, however, not become a habbit to send unencrypted personal information via email.
It might happen that they get sent or received over an open Wifi network, which allows the owner of the network to eavesdrop and when it is unencrypted also anyone else in the network.
Also, the bulk of information which accumulates in domestic and foreign government databases that way could one day make her or her affiliates a target of a dragnet investigation. The more information government entities collect, the higher the likeliness that many points of seemingly harmless data just coincidentally match with that of wanted criminals.
First tell her that unencrypted email is sent via various servers that all can read all information. Then tell her that this happens all the time, and still it seems like all this information is seldom stolen.
Then teach her about password protected zips and Word documents. Or even better... PGP?!
... it's insecure; any combination of mailservers & infrastructure between the email leaving her and getting to her folks could've read it, or stored it to read later. This is just the kind of thing it turns out the NSA is collecting!
Realistically, this happens all the time, it's not very likely she'll suffer identity theft. If you're in america I think you can do things to freeze your credit if you believe you're at risk of identity theft etc. I think that could be an over-reaction for this but may not hurt.
Just tell her that next time it may be better (at the very least) to use an encrypted zip and SMS the password. (I know encrypted zip isn't great, but almost anyone can deal with them)... even the average lay person. The later versions offer not-so-terrible encryption.