It wasn’t until April 2015, when a private computer-security contractor working for OPM flagged an error on a domain name—in this case “opmsecurity.org”—that the agency’s cyber team began to investigate in earnest. The domain had been operating for about a year, but no one at OPM had created it. Worse, it was registered to “Steve Rogers”—a fictional character better known for his exploits as the superhero Captain America, one of the Avengers. A second website, discovered shortly afterward, was registered to his comrade Tony Stark. Connoisseurs of hacking techniques immediately observed that a
...more
