The attackers broke into an administrator's account at the Office of the Comptroller of the Currency, monitoring employee emails and accessing roughly 150,000 emails from May 2023 until they were discovered and ousted earlier this year.