P2019-ND-161

An employee of an agency of the Organization was the victim of a phishing incident in the fall of 2018. All the victims of this first incident resided in Quebec. After resetting his password, the employee inadvertently used his old password that had been the subject of the phishing incident. The hacker was again able to take control of the mailbox and had the opportunity to access all the emails in the employee?s mailbox and the personal information in the emails. The hacker took control of the email box and sent phishing emails to contacts obtained from the email box. The incident was discovered by the employee on February 27, 2019.