Multiple users clicked a phishing link from a compromised email account.

This is part of the user education step after a security incident to prevent future occurrences.

From Quentin Docter – Complete Study Guide:

“User education and awareness is a crucial part of preventing phishing attacks. After an incident, it is vital to train users on recognizing suspicious messages.” .