Subject: Re: FW: Gianetti, Ed
From: "McGowan, Brian" <[email-masked]>
To: "Ellis, Joshua" <[email-masked]>, "Kuczer, Duane" <[email-masked]>
Cc: "Melanson, Steve" <[email-masked]>
Date: Sun, 17 Dec 2017 21:13:37 -0500

Duane, can you confirm that all involved have changed their passwords as instructed last Thursday?

Get Outlook for Android

From: Kuczer, Duane

Sent: Sunday, December 17, 2017 8:18:54 PM

To: Ellis, Joshua

Cc: Melanson, Steve; McGowan, Brian

Subject: FW: Gianetti, Ed

Josh,

After the event on Thursday, we asked Lynne to start checking Ed’s account for suspicious activity.  Please see her comments below.

Duane

From: Silvia, Lynne

Sent: Sunday, December 17, 2017 8:08 PM

To: Kuczer, Duane <[email-masked]>

Subject: RE: Gianetti, Ed

You will have to ask Ed what he uses the Aithent server, but I see that he copies every email to it.  Could the hacker have gotten on this server?

Lynne

From: Kuczer, Duane

Sent: Sunday, December 17, 2017 10:37 AM

To: Silvia, Lynne <[email-masked]>; Melanson, Steve <[email-masked]>

Subject: RE: Gianetti, Ed

What is an Aithent Server?  The subject line was blank.

Steve, do you have the SMTP address of the hacker?  I know you wrote it down.

From: Silvia, Lynne

Sent: Saturday, December 16, 2017 9:50 PM

To: Kuczer, Duane <[email-masked]>

Subject: Gianetti, Ed

Hi Duane,

Looking at the emails being sent by Ed Gianetti in the transport logs, I am seeing that he is sending all of his emails to the Aithent Server.   Have we checked that server to make sure it hasn’t been compromised.

What is the email address of the hacker?  Subject line?

I’m still going through the logs. I’ll let you know what I find.

Lynne