P2017-ND-080

On May 31, 2017, an employee of the Organization sent an email message to the email addresses of approximately 300 customers. The email informed customers that their account was in arrears and requested they contact the Organization immediately in order to resolve the missed payment. The email addresses of all recipients were included in the “To” address line instead of the intended “BCC” address line, inadvertently disclosing the email addresses to all of the recipients. The Organization learned of the incident the same day when it received a call from one of the email recipients. Approximately 25 of the email messages were reported as undeliverable.