When a stolen password reaches a business mailbox

This is a fictional learning scenario. It does not describe a Cyberxperts client, incident or completed engagement.

The situation

Consider an organisation that uses business email for invoices and supplier correspondence. A staff member notices an unfamiliar sign in and a payment request they did not send. The organisation needs to establish what happened before deciding whether other accounts or business records are affected.

The proposed scope

An authorised review would cover the affected account, relevant access records, mailbox settings and the process used to approve payments. Access would be limited to the people and systems needed for the investigation. Investigators would preserve relevant records and separate confirmed facts from assumptions.

The proposed response

The responsible team would coordinate account containment, review access and check for changes that could allow continued misuse. Finance would verify unusual payment instructions through an independently established contact channel. Staff would receive clear instructions for reporting further suspicious messages.

What would demonstrate progress

The organisation should be able to explain which account was affected, what evidence supports the findings and which questions remain unresolved. Follow up work should address access controls, account recovery and payment verification. The result is assessed through evidence and agreed checks, rather than a claim that every risk has disappeared.

Apply this to your organisation

Review who can access business email and who approves changes to supplier payment details. Our security checklist can help organise that discussion. Explore Security Awareness Training and Incident Response, or complete the complimentary Pre-Assessment.

Use the incident preparation guide to agree responsibilities and alternative contact methods before an incident.

Download the incident preparation guide PDF to keep a copy for your planning discussion.