All help articles
AccountsWe fix this for youUrgent
You think a mailbox has been compromised — do this now
If you believe someone else is in a mailbox, treat it as in progress rather than finished. Phone us; do not wait on a ticket queue.
Phone us — do not wait on a ticket.
+1 (314) 339-4936 · Monday–Friday, 9:00 AM – 6:00 PM Central. If it is outside those hours and something is actively happening, call anyway and leave the details.
What it looks like
- ·Contacts report mail from you that you never sent
- ·A rule you did not create is deleting or forwarding mail
- ·Sent Items contains messages you do not recognise, or has been emptied
- ·Sign-in alerts from a country nobody was in
- ·An invoice you sent came back with the bank details altered
How this gets fixed
- 1
Phone us
Call rather than email. An attacker sitting in a mailbox may be reading the mail you send about the incident, and a ticket in a queue moves too slowly for an intrusion that is still live.
- 2
Do not delete the evidence
Preserve logs and capture suspicious settings if safe, but do not delay containment. An authorised administrator should block the compromised account and disable malicious forwarding or rules promptly.
- 3
We revoke the sessions, not just the password
With authorised access, we block sign-in, reset credentials, revoke sessions, and review authentication methods. Some existing access can persist until tokens expire or applications enforce revocation; we verify containment rather than promise an instant cutoff.
- 4
We hunt the persistence
Inbox rules that hide replies, forwarding to an outside address, added mailbox delegates, and consented third-party apps. Password theft is the way in; these are how the access is kept.
- 5
We tell you what was reached
We review the sign-in and mailbox activity available in the tenant and give you a plain account of what was accessed, what was sent, and what you should tell your customers and your bank.
- 6
Warn anyone who received payment details
Invoice fraud is the usual goal. Anyone sent bank details from that mailbox during the window should confirm them by phone, on a number they already had, before paying.
Questions people ask about this
Should I just change the password myself?
A password change alone is not complete containment. An authorised administrator should also block sign-in, revoke sessions, review authentication methods and app access, and remove malicious forwarding. Verify the result because revocation can take time.
Should I delete the strange rules I found?
Capture the suspicious settings and preserve available logs if safe, then have an authorised administrator disable malicious rules promptly. Do not leave harmful forwarding active while waiting for ID360 to reply.
How would you know what the attacker read?
From the sign-in and mailbox activity Microsoft records for the tenant. How much detail exists depends on the licences in place and how far back the retention goes, so we tell you what the records actually show rather than guessing.
Do I have to tell anyone outside the business?
Possibly. If personal data was exposed you may have a reporting duty, and if payment details were sent from the mailbox your customers and your bank need to know quickly. We give you the facts of what was accessed; the notification decision is yours, ideally with your legal advisor.
When to hand it to us
Report it immediately. Phone support during published business hours. Outside those hours, contact your authorised Microsoft 365 administrator or Microsoft support for urgent containment; ID360 does not promise round-the-clock response.
If the fault turns out to be in the Microsoft service rather than your setup, we take it from there — you keep one point of contact.