P2021-ND-166

Between December 19 and 20, 2020, the Organization was victim to ransomware (Sodinokibi), resulting in the encryption of a significant number of servers and workstations. It is reported that an administrative password was compromised as a result of phishing, and was subsequently used in the attack. The Organization reports that the threat actor exfiltrated records from its servers. It is also stated that the attackers eventually destroyed the records they exfiltrated.