The Nuclear Regulatory Commission has been compromised three times in the past three years via email-based attacks. The NRC houses data about the locations, conditions, and inventories of nuclear plants across the globe. Two of the breaches were tracked back to sources outside the US, who used spearphishing messages to coax NRC employees to part with their login credentials. The countries from which the attacks originated were not named in the report. In a third breach, an attacker took hold of an NRC employee’s email account and emailed malicious PDFs to 16 other employees.”]