P2021-ND-338

On March 20, 2021, the Organization was subject to a ransomware attack (Sodinokibi). The breach was discovered on the same day when employees noticed they were unable to access information on affected systems; a ransom note was also found. The Organization reported that the threat actor gained access to the Organization?s network via a brute-force attack against an employee user account. The threat actor subsequently uploaded the malicious payload and exfiltrated records.