Service A: Incident three

Wednesday 9am

You learn that Andrew, a senior member of staff, has sent out thousands of emails to people inside and outside the organisation. Each email advertised pharmaceutical websites and an 'anti-aging' treatment.

• Complaints are flooding into the service's enquiries team.
• Andrew denies sending these emails.
• Andrew uses Office 365 email.
• Your IT provider says sensitive files Andrew had access to have been accessed and possibly copied.