The attack began with a successful phishing email.