The scam diverted the mail of almost 400 people, snatched their identities, and accessed accounts at their name without their permission the release stated.