The situation
A member of staff at a real-estate services firm fell for a phishing email. The attacker signed in with the account and sent a mass mailing of 2,500 mails. In all, the attack reached seven accounts. The firm had no Manage contract with us then: it called on us by the hour.
What we did
Two engineers, in parallel. At the firm’s request, two of our engineers worked on it at the same time from the first day.
Secured the evidence first. We secured the mail-flow and message-trace data and analysed it: the sign-ins, the account’s activity, the phishing email and the chain of the attack.
Took out what the attacker had left. We removed the inbox rules, forwardings and sessions the attacker had set up, and advised the firm how to harden its accounts.
Checked everything around it. A server on the premises and the systems around it, and a deep scan of the network.
Narrowed down who got the mail. We mapped the affected users inside the firm and narrowed down the recipients outside it.
Gave the data protection officer the facts. For the officer’s decision whether to report it: the details for the notification and for the impact assessment. The legal assessment stayed with the firm.
Wrote it up. A short technical report, a version for the firm and a summary for its management.
What it took
Seven days from the first call to the last check. On the sixth day, every session in the firm’s tenant was revoked. On the seventh, the other ways in were ruled out, and the reply to the data protection officer was ready.
What happened next
The way we handled it became our standard response for every client: what happens when someone clicks.