P2021-ND-158

On April 30, 2020, the Organization learned that an unauthorized individual accessed one of its employee?s email accounts. The unauthorized individual sent phishing emails from the account to others at the Organization and later gained access to eight other employee email accounts. The Organization reported that no other employee accounts were affected, nor were other parts of the Organization?s system or business. The Organization reported that it has no evidence that any information was accessed, or that the unauthorized individual was seeking personal information.