P2021-ND-061

On or around March 26, 2020, an employee of the Organization was notified by a third party about a suspicious email sent from the employee?s email account. The employee reported the suspicious activity to the Organization’s IT department. The Organization and a third party cybersecurity firm investigated the incident. The Organization believes that: (a) the employee?s email account was accessed by an unauthorized third party; (b) the period of potential unauthorized access to the employee?s email account is approximately March 17, 2020 to March 25, 2020; and (c) unauthorized access was limited to the employee?s email account and did not affect other accounts.