How you notice an account has been taken over
Often it is not the employee who notices, but someone else. Signs we regularly see in SMEs:
- customers or suppliers receive strange emails in a colleague’s name, often with a link or a payment request;
- the mailbox contains rules nobody created, for example a rule that forwards email to an unknown address or deletes replies immediately;
- Microsoft reports a risky sign-in, for example from a country where nobody from your company is;
- the employee gets MFA prompts they did not request;
- Microsoft 365 blocks sending from the account, because it suddenly sends a very large number of messages.
If in doubt, treat it as a takeover. Stepping in a few minutes too early costs little; a day too late can cost a lot.
Step 1: get the attacker out
Changing the password alone is not enough. Someone who is already signed in can often carry on for a while with an existing session. So do this, in the Microsoft 365 admin center or the Microsoft Entra admin center:
- block sign-in for the account, or immediately reset the password to a new, strong one;
- revoke all sessions, so the account has to sign in again on every device;
- check the sign-in methods: attackers sometimes add their own phone or authenticator app. Remove every method the employee does not recognise and have them set up MFA again afterwards.
Talk to the employee before you release the account again, and make sure they know the new password must not be used anywhere else.
Step 2: clean up what the attacker left behind
An attacker often tries to leave a back door, so they can return later or keep reading along. So check:
- mailbox rules: delete rules that forward, move to an inconspicuous folder or delete email;
- forwarding: check whether a forwarding address has been set on the mailbox itself;
- delegates: check who has access to the mailbox or may send on behalf of the account;
- apps: see whether the account gave consent to an unknown app. Such an app can keep reading email, even after a password change;
- devices: remove unknown devices linked to the account.
Step 3: find out what happened
Next you want to know how far the attacker got. In the audit log and the sign-in logs you can see when and from where someone signed in, which email was sent and whether files in OneDrive or SharePoint were opened or shared. Keep what you find: you will need it for any report and to understand later how it could happen.
Step 4: inform the right people
- colleagues and customers: warn everyone who received suspicious email from the account not to click links or act on payment requests. Call to check if in doubt, just as with invoice fraud;
- management: they need to decide on any report;
- the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): if the attacker had access to personal data, such as customer email or staff records, it may be a data breach. A breach that poses a risk to the people involved must be reported within 72 hours of discovering it. Also record it if you decide not to report, and why.
Prevent the next one
Most takeovers start with a phishing email and an account without proper two-step verification. Turn on MFA for everyone, block automatic forwarding to outside addresses, do not let employees consent to apps themselves and make sure someone keeps an eye on risky sign-ins. Also agree whom employees call when they see something odd: the sooner you hear about it, the smaller the damage.
What Floor ICT does
With a compromised account, Floor ICT blocks access, revokes sessions, cleans up rules, forwarding and unknown apps, and works out from the logs what the attacker did. You get a short overview to decide on a report. Afterwards we go through the settings with you, so the same route does not work again. The decision on reporting to the Autoriteit Persoonsgegevens stays with you.