First hour: stop the access
- Contact your IT provider and, if you have cyber insurance, check whether the policy requires you to call the insurer first.
- Reset the password to a new, unique one.
- Sign the user out of all sessions. In Microsoft 365, an administrator can revoke active sessions so a stolen session can't keep working.
- Check MFA methods. Attackers sometimes add their own phone or authenticator app. Remove anything the user doesn't recognize.
- Consider blocking sign-in temporarily while the account is reviewed.
Don't delete evidence. Your IT provider or insurer's investigators may need the logs and messages.
Next: look for what was left behind
Attackers often set things up so they can keep watching or come back later:
- Inbox rules that move, delete or forward messages, often ones mentioning invoices, payments or "hacked."
- Forwarding to an outside address.
- App consents, meaning third-party apps given access to the mailbox.
- Sent items and deleted items showing messages to clients or vendors, such as fake invoices or changed payment instructions.
- Sign-in history showing unfamiliar locations or devices.
- Other accounts. Was the same password used elsewhere? Did other staff receive messages from this account?
Microsoft publishes a detailed checklist for administrators. We list it in the verification sources below.
Then: who needs to know
- People who received messages from the account, especially anyone who may have been sent payment instructions. Call them using a number you already have.
- Your bank, right away, if money may have been sent. Speed matters for any chance of recovering a transfer.
- Your insurer, according to the policy's requirements.
- Possibly regulators or affected individuals, depending on what personal information was in the mailbox and where those people live. For CPA firms, the FTC Safeguards Rule has its own notice requirements. Talk with your attorney about what applies to you.
How we handle it at Blue Tree Technology®
We have a documented process for this, and it follows the same order. First, we collect evidence, so there's a record of what the attacker did and what they could reach. Then we work on removing them from the account and closing the ways back in. In some cases the next step is to get your insurance company involved, or your attorney. In extreme cases, it may also mean contacting law enforcement. Which of those apply depends on what was in the mailbox and what the attacker did with it.
How it probably happened, and how to make it less likely
Common causes are a convincing phishing page, a reused password or an MFA prompt someone approved without thinking. Steps that help:
- MFA for every account, using an authenticator app or phishing-resistant options for high-risk users
- A password manager so passwords aren't reused
- Alerts for new forwarding rules and unusual sign-ins
- Training on how to report a suspicious message
FAQ
Is changing the password enough?
No. Existing sessions, attacker-added MFA methods, inbox rules and app consents can all keep access open after a password change.
Should we email our clients to warn them?
Usually a phone call to anyone who may have received fraudulent payment instructions is the most urgent step. For broader notices, get advice first, because the wording and timing can have legal consequences.
How do we know whether data was taken?
That requires reviewing logs, and the logs available depend on your Microsoft 365 licenses and settings. Your IT provider and, if needed, a forensic team can help.
Verification sources
- Microsoft Learn, "Respond to a compromised email account": https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account
Still have a question?
If this is happening right now, contact your IT provider immediately. If you're a Blue Tree Technology® client, call our support line at 816-994-8282. For an emergency, leave a message and our whole team is alerted. For general questions, ask Little Sprout, or schedule a free 15-minute discovery call.