P2021-ND-318

On January 17, 2020, The Organization discovered suspicious activities in its email accounts. The Organization determined that threat actors accessed two mailboxes frequently, between September 17, 2019 and January 17, 2020. A third mailbox was accessed twice, on September 21 and 23, 2019. The Organization?s investigation also found that four links had been created for document transfers from the account. The Organization reported, ?evidence was not available to identify which emails were accessed? or ?which files were contained in the links, nor whether the links were accessed by the threat actors.?