P2017-ND-031

On August 16, 2016, the Organization received an email from an individual requesting an email address be linked to a customer account. The Organization approved the request, which allowed the individual to access the account and make changes. On September 30, 2016, the Organization became aware there had been a breach when a customer contacted Customer Service to report he had not received his monthly account statement.