During an internal audit at a healthcare provider, an auditor finds that several employees have been using their work email accounts to sign up for personal subscriptions and online shopping. Given the sensitive nature of the healthcare industry and the organization's recent adoption of an Acceptable Use Policy (AUP), which of the following is the MOST significant risk this behavior poses to the organization? A. Compromise of employee credentials leading to unauthorized access. B. Increased spam and phishing attacks targeting the organization. C. Violation of HIPAA regulations due to potential PHI exposure. D. Network congestion due to non-work related email traffic