Why are we suddenly getting so much spam and phishing?

A sudden increase usually has one of a few causes:

• An address appeared in a data breach somewhere else and has been sold on. Role addresses such as info@ and sales@ get hit hardest because they are public by design.
• Your domain is being spoofed. If people tell you they received mail from you that you did not send, your domain is being impersonated, and SPF, DKIM, and DMARC records are the fix.
• Someone's mailbox is compromised. If spam appears to come from a colleague, treat it as urgent rather than annoying and call us the same day.
• Filtering was never really configured. The default protection in Microsoft 365 is decent and is frequently left at defaults that let far too much through.

What not to do: never use the unsubscribe link on mail you did not sign up for. It confirms your address is live and read by a person, which makes it more valuable, not less.

What to do instead: report it as phishing or junk using the button in Outlook rather than deleting it, because that trains the filter for your whole organization, not just your mailbox.