Threat actors compromised Foundation's internal mail systems to blast phishing emails directly from legitimate company email addresses