We think a mailbox was compromised. What do we do in the first hour?

Order matters here, and a couple of the instinctive reactions make things worse. If you are reading this during an incident, start at the top.

The first hour:

• Call us. Monday to Friday, 8 AM to 5 PM Eastern on 904-204-6870. A suspected mailbox compromise is a critical issue and gets our one hour response. If money is in flight, say that first, because it changes what we do in what order.
• If a payment has already gone out, call the bank now and in parallel. Do not wait for us. Ask for a recall or a SWIFT indemnity on a wire, and say the words business email compromise, because banks have a process for it. Then report at ic3.gov, which is the FBI's Internet Crime Complaint Center and is what triggers the Financial Fraud Kill Chain for a domestic wire caught quickly. Hours matter, and after about 72 hours the odds fall off sharply. There is a separate article in this topic on a payment that has already gone to the wrong account.
• Change the password, from a different device. If the machine itself might be compromised, changing it from that machine hands over the new one.
• Understand that a password change alone does not evict them. An existing signed-in session keeps working. Sessions have to be revoked and any authenticator they registered has to be removed. We do that, and it is the step most people do not know about.

What not to do:

• Do not delete the rule, the forward, or the emails. That is the evidence that tells us what they were watching and what they likely sent. We record it, then remove it.
• Do not email the affected person to ask about it. The attacker is reading that mailbox. Call them.
• Do not quietly handle it. If their mailbox was being read, your customers and suppliers may be getting mail from them right now.

What we do: revoke sessions and lock the account, pull the sign-in and audit logs to establish when access started and what was accessed, find every rule and forward, check whether anything was sent from the account, check whether other accounts are affected since one compromise is often several, and then tell you plainly what we found, including the parts we cannot determine.

And the part that gets forgotten. If they were reading the mailbox for two weeks, your customers and suppliers were exposed to whatever was in it, and may be targeted next using what was learned. Warning them is uncomfortable and it is the right thing to do, and we will help you write that message.