P2020-ND-104

On May 9, 2019, an employee of the Organization noticed unsolicited emails had been received at internal email addresses.
The Organization investigated and found that between May 4-8, 2019, a series of emails were sent to approximately 10,000 subscribers by a third party email services provider used by the Organization.The emails did not originate from the Organization?s account with the email services provider but instead came from the account of an employee of the Organization. The employee claimed that the information was uploaded by accident. However, the Organization notes that the employee had separate business interests from those of the Organization and believes the incident may have been a deliberate attempt to solicit business using the Organization?s information. The employee confirmed the information was not used for any purpose other than to send the emails.