On Monday, August 10, 2026, at approximately 6:00 p.m., Cyber Threat Detection Michael Shafer detected an alert indicating that several state employees and shared mailboxes had received an email containing a malicious attachment. The message originated from a compromised account belonging to a K–12 school employee. 

By 6:30 p.m., Shafer had tested and verified the threat, removed all instances of the malicious email from affected mailboxes, and notified the school that their account had been compromised and was attempting to distribute malware to external organizations. 

His quick after‑hours response prevented the malicious email from reaching state employees and shared mailboxes before the start of the next workday, significantly reducing the risk of infection and further spread.