Attackers gained undetected access to the agency's email system for over a year and a half compromising approximately 150,000 emails.