P2018-ND-039

On August 19, 2016, an employee with the Organization sent an email to forty-nine (49) new employees regarding an upcoming training session. On August 26, 2016, the Organization received a report that a zip file attached to the email contained the personal information of sixty-four (64) other employees of the Organization. The employee who sent the email was unaware of the contents of the attachment. The personal information in the file was not properly secured or protected by restricted access. On August 31, 2016, the Organization emailed the recipients of the email and instructed them to disregard the file and to delete and/or destroy any electronic or hard copies they may have had of the file.