Business Email Compromise: First Actions for an Organization
The first response should regain control, preserve evidence, check for persistence, and protect downstream business processes that trust email.
Treat the mailbox as part of a business workflow
Business email compromise can affect more than messages. Payment approvals, password resets, customer communications, document sharing, and internal trust may all depend on the affected identity. Identify the business processes that could have been influenced while access was uncertain.
Preserve and contain
Preserve relevant alerts, sign-in records, suspicious messages, forwarding rules, delegates, and known timestamps. Then regain account control using the organization’s authorized recovery process and review sessions, MFA methods, recovery details, inbox rules, external forwarding, and privileged access.
Verify high-risk transactions out of band
If the mailbox participates in payment, banking, payroll, vendor, legal, or sensitive client workflows, use a trusted communication channel that does not depend on the compromised mailbox to verify high-risk instructions and notify the appropriate internal or external parties.
Close persistence and process gaps
After containment, review why the event was possible and whether email alone was allowed to authorize high-impact changes. Technical hardening and operational verification controls often need to improve together.
Sources and further reading
- Microsoft — Respond to a compromised email account in Microsoft 365
- Canadian Centre for Cyber Security — Developing your incident response plan
This is general technical guidance. Apply it to your environment with appropriate authorization, evidence, and incident-specific context.