P2021-ND-116

On June 25, 2019, an employee with the Organization was corresponding with a client who advised that they had made wire transfer payments to the Organization. The Organization did not receive any payments. On July 2, 2019, the Organization discovered that an employee’s email inbox had been breached by an unknown third party, and an email forwarding rule was enabled which forwarded all inbound emails to an unknown gmail account. The Organization also discovered that the unknown third party had sent emails from the employee’s account, including to a client of the Organization regarding payments and banking info for fraudulent purposes and to divert funds. On July 5, 2019, the Organization discovered additional forwarding rules were enabled on the employee’s account on July 2. The Organization immediately disabled them. The Organization undertook a comprehensive review of all emails forwarded to the unknown gmail account during the relevant periods (May 27 – July 2 and July 2 – 5, 2019) and determined that three (3) emails potentially contained personal information.