Someone "clicked on a link in an email" and unwillingly enabled the theft of sensitive data.