P2019-ND-068

On or about January 15, 2019 a staff member’s personal Gmail account was phished. The Organization reported the account ??likely contained [the employee?s] work password, they planted a pdf on the individual’s work OneDrive that they then shared out to some clients and employees in the address book. The second, third and fourth person opened the shared file and entered their user and password, their account was considered compromised at that point?. The Organization reported the phishing email originated from inside the company. The incident was discovered on January 21, 2019.