A small but troubling minority of users click on links embedded in phishing emails and an even smaller number recognize and report the suspicious emails to an IT group or incident response team.
The good news for WordPress users is that there are multiple security plugins available that enhance site security, provide routine (even continuous) monitoring, and help administrators remove and repair whatever changes or damage an intrusion has caused.
Subsequent disclosures and updates about the OPM incident paint a troubling picture of the poor security practices that facilitated the attack and delayed its discovery.
Dark Reading
SecurityArchitecture.com