We got phished. What happens in the first hour?
Speed matters more than blame. The goal in the first hour is to cut the attacker off, work out what they touched, and stop the same trick working on the next person.
Business email compromise is the most common incident we handle. Somebody enters their credentials on a convincing page, and an attacker is inside the mailbox within minutes — often before the person realizes anything is wrong.
Minutes 0 to 15: cut access
- Reset the password and revoke all active sessions and refresh tokens. A password reset alone does not remove an attacker with a live session.
- Review registered MFA methods and remove anything the user does not recognize. Adding their own authenticator app is the standard way an attacker keeps access.
- Block sign-in entirely if there is any doubt.
Minutes 15 to 40: find out what they did
- Check inbox rules. Rules that move mail from finance, or from a named supplier, into an obscure folder are the classic sign of an invoice fraud in progress.
- Check mailbox delegation and forwarding, including forwarding set at the mailbox level rather than in the rules.
- Review the sign-in log: where from, on what device, and which other accounts show the same pattern.
- Check whether anything was sent from the account, and to whom. Phishing sent from a trusted internal address is far more effective than anything from outside.
- Look for file access and download activity in SharePoint and OneDrive.
Minutes 40 to 60: contain the spread
- Purge the phishing message from every mailbox that received it, not just the one that clicked.
- Warn the recipients of anything sent from the compromised account, especially where payment details were discussed.
- Check whether any other account signed in from the same infrastructure.
Then, the same day
Work out how it got through, and close that path. Usually it is a Conditional Access gap, MFA not enforced everywhere, or a mail filtering rule that let the message land. Document what happened for your own records and, where personal data is involved, assess your PDPA notification position.
The uncomfortable part
Most organizations discover this timeline for the first time during the incident. If nobody has the access to revoke sessions at 9pm on a Friday, the first hour becomes the first morning, and by then the invoice has been paid. That is the argument for 24/7 monitoring — not the technology, the availability of someone who can act.