Maryland's Office of the Inspector General for Education released its investigative report for the “catastrophic” Baltimore County Public Schools cyberattack revealing how it happened and areas where the school system is to blame.

The report reveals that the ransomware attack that crippled the school system was unleashed by a security contractor who “mistakenly” opened a suspicious email on the school's unsecured email system.

According to the report, an “education professional” received an email that appeared to be an invoice from a college official. It was actually a phishing attack, according to the report.

Phishing attacks target people by sending them emails from what appear to be well-known sources, according to the Federal Trade Commission.