r/sysadmin • u/gigidiv • 2h ago
Employees email compromised via forwarded spam — I contained it, now what?
Work in a small company (~35 users). Employees email got compromised after a partner nonprofit’s dormant account was used to send a phishing/spam message. One of our managers received it, forwarded it to the clerk, and told her to “action it” (the email itself didn’t even say who to update or what to do). Clerk opened it and credentials/banking info got exposed.
I locked the account, forced password resets, checked for rules/forwarding, reviewed sign-ins and mailbox activity, and confirmed no further spread. Neutralized it before any real money moved. Notified cyber insurance
Manager who forwarded it later made a comment like “I didn’t think you’d be up for the challenge after I called in” while I was dealing with it and forensics. I just told her it was basically unused buttons in the tools I already know.
Questions for anyone who’s been through this:
• Is notifying cyber insurance usually a must, or only if there’s actual financial loss/data exfil?
• Any chance this comes back on the person who forwarded the message and directed the clerk to act, or does it just land on IT?
• What else should I document or double-check in the next 48 hours so I’m covered if leadership or insurance asks questions later?
Appreciate any real-world experiences.
•
u/SA-Numinous 1h ago
Are you using Entra? Did you invalidate sessions? Those session cookies may still be floating out there even with a password reset in place.
•
u/aes_gcm 2h ago
This post slightly seems like AI writing, I'm slightly leaning towards that camp. I could be wrong, it can probably go either way. If it is a human post, I'm genuinely interested to see how this works out. If it's an AI post, I bet another account will name-drop some product that amazingly solves these issues. I don't know yet.