There has been a rash of reports from people whose Macs have been locked remotely via Find My Mac, with the criminals responsible holding the Mac hostage until they receive a ransom in Bitcoin. First, if this happens to you, do not pay the ransom! Any Apple Authorized Service Provider or Apple Store can unlock your Mac for you if you bring it in and provide proof of purchase. Second, if you ever used your iCloud password on another site, change it immediately! The reason this is so important is in the case that site was hacked, then your iCloud account is now vulnerable. Unfortunately, Apple’s two-factor authentication, which is otherwise great, does not currently protect against this problem!
Again, please use a password for iCloud.com that is memorable to you, and NOT used on any other website.