P2021-ND-001

On December 22, 2020, a payroll administrator sent an email attaching employee payroll earning statements to the operations manager and the president for review ahead of submission to the bank for bi-weekly payroll. Earlier that day, the operations manager had received a phishing email; the sender represented themselves as the Organization’s president. As a result, when the payroll administrator sent the email to the operations manager and the president, the cache in her inbox attached the phishing email address rather than the president?s correct email address. The operations manager saw the mistake and immediately contacted the sender to recall the email. However, because the operations manager had already opened the email, the recall was unsuccessful. The Organization cannot confirm whether that is because the third party opened it or whether it was because the operations manager opened the email. The email with the attachment was not encrypted.