Business email compromise
Email is sending as you. That is an identity incident, not a spam filter.
Inbox rules you did not create, a vendor who got a fake wiring change, payroll that went to the wrong account, or a Microsoft 365 admin you no longer trust. Avery Parker contains that. Pricing after discovery — same practice as the rest of incident response.
Call 423-888-0252 Send an urgent request Microsoft 365 (when it is not on fire)
What this usually is
Someone has the mailbox, the tenant, or both. Typical doors: reused passwords, no MFA on a privileged account, a forwarded inbox, an OAuth app nobody remembers approving. The homepage of the company can look fine while invoices are being rewritten in transit.
What not to do
- Do not email the attacker “who are you?” from the same tenant.
- Do not reset every password and walk away. Forwarding rules and mailbox delegates survive a password change.
- Do not assume “Microsoft already caught it” because one user got a warning.
If files are encrypted or servers will not boot, start at ransomware response. If it is only the public WordPress site, start at hacked WordPress.
Questions we get
Email is sending as us. Is that ransomware?
Usually not. It is a mailbox or identity problem: a rule forwarding mail, an inbox delegated to an attacker, or a password that is also the Microsoft 365 global admin. Still an incident. Call.
Should we reset everyone’s password first?
Reset the accounts that are sending. Do not lock the whole tenant before someone can still get in to stop the forwarding rules. We will say which order on the call.
Payroll went to the wrong account.
That is a business-email compromise with money attached. Call us and, if you have a cyber or crime policy, that number as well. Do not wait on a perfect timeline to freeze what is still moving.
Need the mailbox stopped from sending?
Tri-Cities 423-888-0252 · Western NC 828-484-1257