News
The phishing email comes from a real colleague. What now?
A compromised business mailbox makes the sender credible. Organise containment, investigation and a controlled return to work.
The sender is correct. The name is familiar. The invitation fits everyday work. The message can still come from an attacker: taking over a real mailbox means inheriting its credibility. Asking “Does the address look suspicious?” is no longer enough.
A genuine account as the starting point
On 20 October 2026, t3n reported that a mailbox belonging to the CDU’s Heilbronn district association had been compromised. More than 6,500 phishing messages were reportedly sent through it. According to the report, the attackers’ original route into the account had not been conclusively established. This does not demonstrate that a particular email provider or authentication method failed.
Sources as of 24 October 2026. Our focus is the operational response to such a report. The following steps provide a working basis for IT teams; they do not replace investigation of the particular account.
The first report needs someone reachable
Suppose an employee receives a document link from a colleague and becomes suspicious after being asked to sign in again. This is our fictional example, not another reported incident.
She should know how to reach IT through a trusted channel. If email is affected, a telephone number or another agreed channel must also be available. She describes whether she only saw the message, opened the link, entered information or approved a sign-in. Those distinctions help the investigation. Passwords do not belong in the reporting ticket.
The helpdesk initially needs four details: the affected account, time, suspicious message and actions already taken. Record them together rather than repeating the questions across several chats. A working employee reporting channel makes this faster.
Stop access and preserve evidence
Assign someone to coordinate the incident. The responsible administrator preserves relevant logs and restricts access. Urgent containment should not wait for complete documentation; record the time and action in the same case as the response proceeds.
For Microsoft 365, Microsoft describes disabling the account, resetting the password and revoking active sessions, among other steps. Registered MFA methods, application consents, forwarding and inbox rules also need investigation. A password change alone does not answer these questions. The sequence depends on the situation and Microsoft’s current guidance for compromised accounts.
The useful outcome is therefore more than “password changed”: which access paths were checked, which were removed and which remain unresolved?
What could the account reach?
A mailbox can be part of a broader identity. Microsoft points out that associated services such as SharePoint and OneDrive also need investigation. For internal coordination, we recommend a simple separation:
| Question | Responsible role in this example | Result to record |
|---|---|---|
| Were further messages sent? | Email administration | Recipients and sending period |
| Were rules or permissions changed? | Identity administration | Change, remediation and verification |
| Were other services accessible? | Respective service owner | Services checked and remaining uncertainty |
| Do people need to be informed? | Incident coordination with privacy and communications teams | Recipients, channel, content and decision |
A clear list of permissions and owners helps more than a blanket statement that the account “only does email”. Do not limit the investigation to what appeared in the first report.
Restoring access is a decision
Before the affected person resumes work, you need understandable criteria. In our example, administration confirms that sign-in and account configuration have been cleaned up and checked. Incident coordination records which investigation work is complete and which continues. The business team receives a safe alternative while normal access remains blocked.
During the review, ask what may have enabled the attack. Immediately prescribing awareness training would be premature while the entry point is unknown. A technical control may be missing, or the reporting channel may be unclear. A measure needs a connection to the identified problem and, later, evidence of its effectiveness.
Test your process today with one question: Who would stop suspicious messages being sent from your managing director’s mailbox if that person were unreachable? If nobody has a specific answer, start there.