Not just that, but devices as well. First rule in Black Hat is keeping your mouth shut when you find an exploit. With practically everyone now having phones on them 24/7, or insecure internet connected devices at home, the attack surface area is everywhere. Almost a guarantee that government employees are targeted specifically for attack, and a large number are, or have been compromised at some point.
The only way to help prevent such things is force government employees to abide by specific security practices for devices, which is practically impossible.
I work for a small medical firm nobody has ever heard of. Almost all our employees are targeted within a week of hiring on their personal devices with spearfishing trying to get company creds. It's insane.