Apparently she got a bit upset and nearly started to cry when she was told what she had done.
The email was basically a blank email, no subject, just an excel attachment with 'Sent from my iPhone' in the body from a completely random sender, opened the attachment and thought enabling the macros and running them would be a good idea.
So.... despite years of warnings and IT security advice, best practice articles, warnings from friends and family... what on earth possessed this person to open this email rather than delete it?
The answer is of course curiosity; people are incredibly reluctant to delete something rather than open it, seemingly no matter what I.T. does or says.
Until senior management start realising this, and treating such actions as disciplinary measures, it's not going to improve any time soon. (I appreciate GreyFox's predicament, and in that case I would have course make an exception)
Just wait until locky, or the next variant is developed further: Future iterations will become:
a) network aware, and remain network resident despite cleanup attempts
b) hardware resilient - if they can find a way into BIOS or unpatched firmware, expect it
c) botnet-like password hunting. They'll scour your network for any passwords, no matter how encrypted, and sling them off to a remote server to rainbow table crack and then use against you in a week or 2's time
Oh yeah, I'm ever an optimist!
