Steps To Take If You Suspect Your Microsoft 365 Account Is Compromised

In our recent article, Google and Microsoft 365 Attacks On The Rise, How To Reduce Your Risk, we talked about the recent trend toward compromised business email attacks and how to make yourself less of a target.  But, what if you think your account has been hacked?  Maybe you are seeing ‘rules’ in Outlook or Gmail that you didn’t create.. or Sent Items you didn’t send.. or hearing from people that you are sending them Teams messages or calendar invites about invoice changes.  Here are the immediate steps to take, and some thoughts from ESG on a good long-term plan to prevent re-infection.

What do I do first if my account is possibly hacked?

1. Change your business email password.. you will probably do this TWICE.. once right away, and again after you scan your devices just in case the hackers left behind a method to intercept emails (like forwarding rules).  Still, this at least should slow down an attacker.
2. Raise the alarm.. notify coworkers, and contact us at ESG or your IT provider.
3. Deep scan for suspect changes on your accounts and for malware on your laptop, desktop, and mobile devices.  If working with ESG, we will help you with this.
4. Check for and remove unwanted Outlook or Gmail add-ins, rules, and browser extensions.  Watch for any forwarding rules or new MFA devices/methods.  This is critical to do BEFORE you start the second round of changing passwords because if the hacker can see your e-mail, they can get potentially intercept the new password reset requests you are making.
5. Reset your business email password for the second time, and then work through any/all affected passwords – your  Apple or Google password, your banking/credit card password, HR or accounting platforms, invoicing systems, and websites where you do purchasing.
6. Enable multi-factor authentication on all platforms that offer it.  And enable login notifications to your cell phone/text so you get notified when you (or NOT you) has a successful login.
7. Stay alert.. hackers will try to trick you again by using invoices, vendor names, and past email chains to create new attacks!

What do I do after I get the first steps completed?

1. If you have any reason to think the hacker was sending e-mails, instant messages, or texts as you, let your contacts know that your e-mail might be compromised and to CALL YOU instead of e-mailing if they get any odd requests or financial correspondence from you.
2. Check with Verizon/AT&T or the local Apple Store about your phone’s security and health.
3. Contact ESG about getting 1Password setup for yourself or your whole business.  It has benefits besides just safely keeping all your passwords.
4. Ask us about ways to add enterprise-class AV and EDR to all your systems, along with anti-phishing and encrypted backup layers to your business email hosting.
5. Watch your accounts for anything suspect.. and check your rules, Deleted Items, Junk Mail, and Sent Items very carefully for any signs of tampering or messages/rules you did not create.  Hackers sometimes wait days or even weeks before trying to regain access.
6. Check your platforms for any new documents or links you didn’t create.  Often hackers will try to move laterally into a SharePoint, Docusign, or Google Drive to then send out suspect invoices or additional infection links disguised inside documents.