Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!

IRD's phone calling campaign about enabling two-factor auth was also not great.