Gordon is a new manager$-$level employee at HCLTech. One week after starting his position, he receives an email that appears to be from "The IT Support Centre" which requires that he verify his "company password" is strong enough as a new employee.

The email has a link that takes Gordon to an HCLTech$-$branded page with a form to enter his email address and password so it can be verified. Gordon wants to make sure his passphrase is strong, so he fills out the form.

Fonnected to his position, Gordon has already been added to a OneDrive folder that contains restricted institutional data.

What is the outcome of this situation? $*$

Gordon gave up his HCLTech email address and passphrase to the scammers. They now have his usemame and passphrase for all his HCLTech services that use those credentials.

Gordon safely verfied the strength of his password.