P2016-ND-34

The Organization reported that in two separate incidents, an employee of the Organization received phishing emails. One email appeared to be from the Organization?s Vice President and Chief Financial Officer and a second email appeared to be from the Organization?s President and CEO. The first incident occurred on February 24, 2016, and the second on March 18, 2016. Both emails requested 2015 W-2 forms and T-4 forms for the Organization?s employees. The employee responded to both emails, including copies of the Internal Revenue Canada W-2 forms and Canada Revenue Agency T-4 forms of the Organization?s employees. After the employee responded to the March 18 email, the employee received a third email, which again appeared to be from the CEO of the Organization. This email requested 2015 W-2 forms and T-4 forms. The employee then called the CEO of the Organization to confirm if he had received the W-2 forms and T-4 forms that the employee believed she had previously sent to the CEO. The conversation confirmed that the CEO did not make any request on March 18. The employee also told the CEO of the February 24, 2016 request that appeared to have been made by the Vice President and Chief Financial Officer.