Subject: MLP Incident Follow-Up
From: "McGowan, Brian" <[email-masked]>
To: "Zoltick, Steven" <[email-masked]>, "Melanson, Steve" <[email-masked]>
Cc: "Ellis, Joshua" <[email-masked]>
Date: Tue, 19 Dec 2017 17:27:20 -0500

Steve, Steve Z, as discussed earlier today, here’s an update on the MLP movie incident.

The corporate security team continues to lead the movie leak incident.  Through our research we uncovered that DHX sent an email to a Hasbro employee that contained the user ID and password to the company’s FTP server.  We believe the MLP
movie was transferred using the FTP server (we will confirm).  If so, the IT security team believes that investigation has run its course and we can point to the FTP server as the source of the leak.

The movie leak spawned a secondary investigation in to the potential of Hasbro employee email compromise.  A Russian “hacker” sent an email to Leslie Wishnevski, which contained several emails from Hasbro employees, which led us to believe
someone gained access to an employee’s O365 email account (note that we do not suspect any unauthorized access to the corp. network or internal systems).  We’re currently looking in to three accounts.  It’s likely the accounts were compromised through some
type of social engineering attack resulting in the employee (or potentially multiple employees) disclosing their passwords (e.g., phishing email).

Our focus is now on analyzing the machines and user access logs associate with three employees to determine which accounts of the three O365 accounts were compromised and how.

Brian