P2018-ND-054

In December 2017, the Organization uploaded a list created from its subscriber data to an industry platform called MailChimp, intending to inform subscribers about information available through digital assistants. On April 16, 2018, the email account of an employee of the Organization was hacked and the perpetrator accessed the MailChimp account, stealing approximately 55,000 email addresses. The Organization discovered the incident on April 17, 2018 after receiving a notification from MailChimp advising that the export of email addresses was complete. The action was not initiated by the Organization.