P2020-ND-142

On December 2, 2019, files in a number of the Organization?s systems were encrypted by an unauthorized third party who demanded a ransom payment in exchange for the keys to decrypt the files and to destroy data that the unauthorized party claimed to have taken from the Organization?s systems. The Organization reported that it believes that the unauthorized third party gained access to its IT infrastructure on November 20, 2019. The Organization later confirmed that certain data, including employee files, was accessed by the unauthorized third party and downloaded to the unauthorized third party?s server. The Organization?s forensic experts confirmed that this information was deleted from the unauthorized third party?s server, but the Organization cannot rule out the possibility that a copy of the information remains with the unauthorized third party.