A New York Times report published Wednesday revealed a large-scale attempt to hack the Associated Press in 2014 that successfully gained access to the corporation’s email system and exposed more than 2.6 million password reset emails, according to the company. The attack occurred over four days between June 19 and 22. Security experts that the New York Times spoke to indicated that a phishing scheme using a fake Associated Press email account used to send a request for password reset information to more than 100,000 email accounts. The attack used so-called spear phishing methods and was likely to benefit a specific country or group, rather than simply a criminal. Related: What Are Phishing Attacks? A cyberattack such as the one on the Associated Press is likely to affect the reputation of a media organization more than individuals. The company and/or the government of the country where the attack originated can be held responsible for any damage done to corporate or government websites and communications systems. This sort of attack was likely to generate headlines and likely to be used as fodder for an attack on the company that came from more friendly political sources. However, individuals whose accounts were hacked as a result of an attack on the AP and another major U.S. newspaper, the New York Times, could use that vulnerability against the companies that lost control of their data. Related: What is a 'Sensitive Merchant' Payments Regulation? Individuals who may have had their emails or user name and password exposed could use that information to try to steal from the companies in the same way that they could have used it to send fraudulent emails or obtain private information. “Individuals could have gotten a notification of suspicious activity that had come from the AP. Or they could be notified that they had inadvertently used a password for the AP and, perhaps, clicked on a link and were exposed to additional malware,” said Jonathan Campos, chief executive of CSA Marketing Group, which advises businesses on the importance of data security. Individuals who had access to their email accounts compromised would have likely had a password set up and configured when they received the fraudulent email. “At some point you would be able to get into an account, at least if it is not expired,” said Campos, who has not worked directly with the AP or the New York Times. Individuals who found out that they had accounts that were compromised could notify their financial institutions and other business that their information was likely exposed. However, those individuals may have been victims of the same attack, and possibly have more than one email address. That is, if someone had 10 email addresses with which to compromise other email users, they could have generated 10 fake emails requesting that each account owner reset their password. Related: Why You Must Update Your Password Now “If you have the same email address, [the attackers] could have targeted you more than once,” Campos said. “If you use the same password across multiple sites, then it is a pretty safe bet that at some point you would have been the target of an attack.” “Individuals should make sure they have the latest security updates installed on their systems, including antivirus and spam filter updates,” Campos added. This post was originally published on March 27. Related video: Tags: Associated Press, password attacks, phishing, spear phishing, security attacks, security news, The New York Times