P2021-ND-247

A document containing personal information about customers was intended to be placed in a password-protected secure folder that could only be viewed within the Organization by those with access to it via password. Inadvertently, the document was placed in a different folder that was not password-protected and whose contents could be viewed online outside of the Organization. The breach was discovered on February 10, 2021, when a member of the public notified the Organization that he had come across the document while searching for his own email address online. The Organization immediately investigated the matter, located the document, and took it down on that same date.