P2015-ND-12

The Organization learned that a phishing email containing a malicious link was sent to some training program attendees. The email appeared to originate from the Organization. The Organization determined that an unauthorized third party exploited a vulnerability and was able to access training attendees? names and email addresses, stored in a database. The same database also contained credit card numbers.