P2021-ND-231

On or about November 11, 2020, a workstation and user account was compromised by an unauthorized third party, enabling a threat actor to access the Organization?s network. On November 14, 2020, after ransomware had been deployed on the network, the Organization?s Information Technology (IT) provider discovered the breach. A ransom note was also found. Further investigation found that the compromised workstation and user account had authorizations and administrative access beyond what was necessary.