It doesn't surprise me. This phenomenon has become an epidemic lately. The employees are usually the vulnerability that these guys look for and is why they need special training when it d comes to cyber attacks.