P2018-ND-150

On March 20, 2018, a partner with the Organization received an email requesting invoice payment from an employee. After verbal verification with the employee and his boss, the Organization realized something was wrong. An internal investigation revealed the Organization had paid a fraudulent invoice on March 12, 2018 and an unauthorised party may have gained access to the Organization?s customer management system (CRM system) through one of its employee?s accounts. The unauthorized party may have accessed the system between February 27, 2018 and March 20, 2018. The Organization reported that none of its computer or network systems were affected by this incident.