P2021-ND-299

On December 16, 2020, as part of a ransomware attack, an unknown threat actor installed malware in the Organization?s system. The Organization determined that the malware harvested and copied usernames and passwords used by its employees to log into the Organization?s system. The malware would have automatically copied usernames and passwords that were in the system on December 16-17, 2020. The attacked was discovered on December 17, 2020. The Organization?s investigation determined that while the threat actor had access to these copied usernames and passwords, there was no evidence that the copied information was exported or misused.