P2017-ND-128

On or about July 21, 2017, a now-former employee of the Organization emailed customers’ personal information from the Organization to his personal email address. Some of the information was used to generate 15 single use cards (all of which were cancelled by the Organization). The incident was discovered on July 25, 2017, when the ex-employee was found to have visited the call center after hours and used the computers, all without permission. As a result, the ex-employee?s network and other activity was reviewed and the breach discovered.