Your Microsoft 365 account was hacked: the first 15 minutes

It usually starts with a message from a customer: "Did you really send me this invoice?" Someone has your email account. What you do in the next few minutes decides whether this is an annoying afternoon or a very expensive month.

This is the order we work in when it happens to a client. If you have an IT provider, call them first. If you do not, start here.

The first 15 minutes: stop the damage

1. Block the account from signing in. A Microsoft 365 administrator can do this in the admin center in under a minute.
2. Sign the user out everywhere. Changing the password is not enough on its own, because the attacker may already hold a session. Revoke all active sessions as well.
3. Tell the right people by phone. The business owner and whoever manages IT should hear it from a person, not discover it in an email thread.
4. Write down what you know. When it was noticed, how, and by whom. You will want this later, and memory fades fast.

The first hour: find out what they did

Attackers rarely just read mail. Check for these before you restore access:

• Forwarding rules. The classic move is a hidden inbox rule that quietly copies every message to an outside address, or deletes replies so the real user never sees them.
• Extra permissions. Another account given access to the mailbox or calendar.
• Sent items from the last two days. Who did they email, and with what? Fake invoices and password-reset requests to your customers are common.
• Sign-in history. Which countries, devices and IP addresses logged in, and since when.
• Files. Whether OneDrive or SharePoint were opened or downloaded.
• Other accounts. If the attacker emailed colleagues from inside, assume more than one person may be affected.

The first day: clean up and restore

1. Remove malicious rules, forwarding addresses and extra permissions.
2. Reset the password to a new, unique one, and require a change at next sign-in.
3. Turn on multi-factor authentication before the account is switched back on. If it was off, that is probably how this happened.
4. Keep copies of the sign-in logs and sent mail for the incident record.
5. Warn the people who received messages from the account, with a short, calm note telling them to delete anything suspicious.

Afterwards

• Decide whether any customer or personal data was exposed. Some situations carry legal notice requirements, and your cyber insurance policy may require prompt notification.
• Look at how it happened: a reused password, a phishing link, or no MFA. Fix that root cause across the whole company.
• Add an alert for new inbox forwarding rules. It is cheap and catches this attack early next time.

Speed matters, but so does thoroughness: a half-cleaned account gets compromised again within days. We handle these incidents for businesses across Butte and Tehama County. If you are in the middle of one right now, call us.