P2020-ND-015

Two employees received a phishing email with a hyperlink. The employees clicked on the link, which took them to a site that looked like a genuine site. Each of the employees entered their credentials into the site. Once the threat actor had the credentials, he accessed the employees’ emails and set up a forwarding rule. The Organization reported the breach occurred on October 15, 2018 and was discovered on July 15, 2019 when suspicious activity was reported by an employee to the Organization?s IT Service Provider, who investigated.