Psychiatrische Dienste Aargau (PDAG) email accounts compromised via phishing and abused to relay spam
Psychiatrische Dienste Aargau AG (PDAG), a Swiss cantonal psychiatric-care provider, disclosed that unauthorised parties gained access to individual @pdag.ch email accounts and abused them to send spam and phishing messages to external recipients (SwissCybersecurity.net, 2026-07-09; Inside IT, 2026-07-08). On discovery, PDAG locked the affected accounts immediately, reset passwords for all employees as a precaution, notified the competent cantonal and national authorities, and engaged internal and external IT-security experts plus its external ICT service provider to analyse and harden. By its current assessment the incident is limited to account misuse for outbound spam/phishing, with no indication that patient data was accessed or exfiltrated; the organisation is warning recipients about suspicious mail purporting to come from its domain.
No technical root cause — the initial-access vector into the mailboxes, whether MFA was enforced, or whether the takeover was via credential phishing or an OAuth consent grant — was disclosed, so the mechanism is unknown rather than assumed. The pattern maps to T1566 Phishing for the initial access and T1586.002 Compromise Accounts: Email Accounts for the takeover and downstream abuse.
Defender actions
- Any Swiss public-sector or health body operating an @<domain>.ch mail estate should implement per-mailbox outbound-volume anomaly detection: a legitimate mailbox suddenly sending bulk external mail is an earlier and stronger compromise signal than waiting for external abuse reports.
- Monitor DMARC/DKIM alignment reporting for your own domain to catch when it starts being used as a relay (authenticated sending from compromised accounts) rather than merely spoofed, and enforce MFA plus conditional-access on all mailboxes.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1586.002Compromise Accounts: Email Accounts
Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains).
Initial Access TA0001
T1566Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.