P2017-ND-038

On December 20, 2016, an unknown individual accessed the email account of the Organization?s CEO and established a ?mail forward? function such that all emails delivered to the account were forwarded to an unauthorized Gmail email account. The Organization reported ?The content of the e-mails and the various attachments related to corporate and business activities and transactions? and some of it was innocuous, consisting of read receipts, and newsletter subscriptions. Some were internal company emails. The incident was discovered on January 3, 2017 when an email which was too large to be received by the unauthorized account bounced back. An evaluation of the Organization?s system showed no evidence of malware, keyloggers or foreign programs or bots.