As a federal employee, I, along with some 4 million other Americans had our information compromised in the recent OPM (office of personal management) hack. Former and current addresses, names of friends and family, salary information, and maybe even social security numbers may have been compromised. What can I do to protect myself and others from the malicious use of my (and coworker's) info? While I know spear-phishing is a likely path anyone after more information may take, what are some other common attacks that follow hacks like this, and how do I recognize and defend against them?
OPM has released statements offering credit protection and advice on how to respond. Phishing e-mails were listed as one of their concerns. Their recommendation was to use anti-phishing plugins to your web browser to help identify phishing e-mails and keep your systems patched. For the layman, that's probably the best you can do.
I believe it's important to understand what the perpetrator would want to do with this kind of personal information.
Note that this isn't the first compromise of clearance information. Two contractors, USIS and KeyPoint have been compromised over the last few years. I've found little written about why they were targeted.
Regarding the motivations behind the OPM compromise, I've seen two trends in the media. One concern is about blackmail and another about social engineering.
Wired has a nice write up on why someone would go after this information. They claim the information could be used by foreign intelligence services to blackmail people in to turning over secrets. Remain vigilant regarding that risk and report it to authorities should you think you're being targeted.
The data that was taken is a treasure of social connections. Your neighbors, parents, co-workers -- all people you trust and would expect to receive messages from. If you are concerned you are being targeted, contact the FBI Internet Crime Complaint Center (IC3) listed in the OPM statement You can also take extra precaution to validate all e-mail attachments you get (especially Office and PDF documents) with the receiver.
One last thing to consider -- this might not actually be about you and I. It may be about identifying and punishing those who are talking to the US government without permission. The Wired article talks to that a bit.