P2020-ND-037

An employee?s email account was compromised and used to impersonate an external software vendor. As a result, a payment sent from the Organization to the vendor was sent to a fraudulent bank account. The breach was discovered on December 10, 2019 when the Organization?s employee informed the IT department of suspicious activity. The IT department identified that the user?s password was likely compromised through phishing. The cyber-attack was found to have exposed the MS 365 cloud environment and but no other systems. The Organization?s investigation identified a total of four (4) email inboxes that were exposed.