Subject: Re: Gianetti, Ed
From: "Melanson, Steve" <[email-masked]>
To: "Kuczer, Duane" <[email-masked]>, "McGowan, Brian" <[email-masked]>, "Ellis, Joshua" <[email-masked]>
Date: Mon, 18 Dec 2017 06:14:18 -0500

Can't Lynne check his email account and see if he has an all email forward rule set up?

Steve Melanson

VP, Global IT Operations

-------- Original message --------

From: "Kuczer, Duane" <[email-masked]>

Date: 12/17/17 9:22 PM (GMT-05:00)

To: "McGowan, Brian" <[email-masked]>, "Ellis, Joshua" <[email-masked]>

Cc: "Melanson, Steve" <[email-masked]>

Subject: Re: Gianetti, Ed

Yes, Ed and the two individuals at Burbank changed their passwords.

Sent from my mobile device.

From: McGowan, Brian

Sent: Sunday, December 17, 2017 9:18:28 PM

To: Ellis, Joshua; Kuczer, Duane

Cc: Melanson, Steve

Subject: Re: FW: Gianetti, Ed

Please keep this within IT for now and do not ask Ed about any suspicious activities.  Josh will do a full analysis of his machine to determine any suspicious activities. The information you provided will get us started

From: Kuczer, Duane

Sent: Sunday, December 17, 2017 8:18:54 PM

To: Ellis, Joshua

Cc: Melanson, Steve; McGowan, Brian

Subject: FW: Gianetti, Ed

Josh,

After the event on Thursday, we asked Lynne to start checking Ed’s account for suspicious activity.  Please see her comments below.

Duane

From: Silvia, Lynne

Sent: Sunday, December 17, 2017 8:08 PM

To: Kuczer, Duane <[email-masked]>

Subject: RE: Gianetti, Ed

You will have to ask Ed what he uses the Aithent server, but I see that he copies every email to it.  Could the hacker have gotten on this server?

Lynne

From: Kuczer, Duane

Sent: Sunday, December 17, 2017 10:37 AM

To: Silvia, Lynne <[email-masked]>; Melanson, Steve <[email-masked]>

Subject: RE: Gianetti, Ed

What is an Aithent Server?  The subject line was blank.

Steve, do you have the SMTP address of the hacker?  I know you wrote it down.

From: Silvia, Lynne

Sent: Saturday, December 16, 2017 9:50 PM

To: Kuczer, Duane <[email-masked]>

Subject: Gianetti, Ed

Hi Duane,

Looking at the emails being sent by Ed Gianetti in the transport logs, I am seeing that he is sending all of his emails to the Aithent Server.   Have we checked that server to make sure it hasn’t been compromised.

What is the email address of the hacker?  Subject line?

I’m still going through the logs. I’ll let you know what I find.

Lynne