P2019-ND-126

On November 6, 2018, an employee of the Organization logged in to their email account from a remote location using an apparently insecure public WIFI hotspot. The employee’s log-in information (username and password) were intercepted by an unauthorized third party. The user’s log-in credentials were subsequently used on more than one occasion by the unauthorized third party to gain access to and manipulate the user’s email address and file folder systems, including requesting a change in bank account information for electronic payroll deposits. The breach was detected on November 15, 2018 when the user returned to the office from vacation and confirmed that the user’s email folders and emails had been tampered with. The user’s email folders were potentially exposed from November 7-15 and contained saved email correspondence. No other system access was attempted or accomplished.