P2020-ND-008

The Organization maintains several email distribution lists for purposes which include promoting the Organization?s annual festival. The email distribution list is managed through a third party, online email management service provider (the Service), which requires users to login to an account using a username and password. Once logged in, a user can access, export, and download a spreadsheet of a specific email distribution list from the Service. On the afternoon of October 1, 2019, the Organization received an automated email alert from the Service which stated that a specific email distribution list had been exported and downloaded. As the account activity and internet protocol (IP) address described in the alert were not immediately recognizable, the Organization investigated to determine whether there had been any unauthorized access to personal information under its control. The Organization was not able to conclusively determine that the export and download was made by authorized personnel.