Citrix said in a later update on April 4 that the attack was likely a result of password spraying, which attackers use to breach accounts by brute-forcing from a list of commonly used passwords that aren't protected with two-factor authentication. We asked Citrix how many staff were sent data-breach notification letters, but a spokesperson did not immediately comment. Under California law, the authorities must be informed of a breach if more than 500 state residents are involved. Read more: