P2021-ND-006

On December 23, 2020, the Organization’s service desk received and opened an email that activated malware. A single computer and single email address were infected. On December 28, 2020, unusual activity in the email account led to it an investigation by IT and cyber security personnel. The virus was discovered and removed immediately. The effect of the virus was not apparent at that time. On January 5, 2021, a customer (insurance company) reported receiving two emails that had spoofed the Organization’s email address; both had been blocked and quarantined by security software. The Organization reported that it is likely that the contents of the affected email account were exfiltrated.
? To date, one commercial customer and one individual customer reported emails spoofing the Organization’s email account; all were blocked and quarantined by security software.