The hackers compromised at least 284 inboxes between September 2024 and March 2026.