A mailbox sends emails nobody wrote
Customers ask about odd invoices or links. Often a compromised sign-in is behind it.
Suspected cyberattack
Suspect an attack? We help, even without an existing contract.
For management and IT in companies without a security team of their own who suspect an attack, for example because a mailbox sends emails nobody wrote or files are encrypted. We contain the incident in your Microsoft environment and record every step with the time. You end up with a timeline for reporting and your insurer and a list of open measures.
Or write to [email protected].
Typical triggers
How do you notice that something is wrong?
Defender raises an alert and nobody knows if it is serious
An alert about an unusual sign-in or device, but no time and no experience to assess it.
Files can no longer be opened
Encrypted data or a ransom demand. Now decisions count that nobody made beforehand.
What needs to happen in the first hour?
The order for a suspected account takeover in Microsoft 365. All checkpoints in detail in the article Incident response in the Microsoft 365 tenant.
-
Management
Appoint a lead
One person decides on blocking, shutting down and communication, with a deputy.
-
From now on
Record everything with the time
Every step and every decision. You need the timeline for reporting and for your insurer.
-
IT
Lock out the attacker
Block the account, do not send the new password by email, revoke all sessions.
-
IT
Check for traces
MFA methods, app consents, mailbox rules, roles and sign-in logs.
-
Check deadlines
Report
Insurer as per policy, authorities under NIS2 and data protection law, affected customers.
Do you need support now?
Call us on +49 30 8632 2038-0. We help even if you are not yet a customer.
Support from WCS
How do we help in an emergency?
Our focus is the Microsoft environment: Entra ID, Microsoft 365, Defender and Active Directory. Your IT provider stays involved.
Containment in the tenant
We lock the attacker out of Entra ID and Microsoft 365 and check what was changed: sign-in methods, app consents, mailbox rules and roles.
Timeline for reporting and insurer
Every step is recorded with the time. The timeline is the basis for reporting, for your insurer and for the follow-up.
Summary and next steps
What happened, what we did, what remains open. Afterwards the Security Assessment shows which gaps made the attack possible.
After the incident
So the next alert does not go unnoticed
The fixed-price Security Assessment shows which gaps made the attack possible. With managed security we monitor your Microsoft 365 permanently and contain incidents within contractually agreed response times.
Frequently asked questions
Who helps us after a cyberattack if we have no security team of our own?
Wenske Cyber Solutions (WCS) also helps companies that are not yet customers. The focus is the Microsoft environment: we lock the attacker out of Entra ID and Microsoft 365, check what was changed and record every step with the time. You can reach us at +49 30 8632 2038-0 and [email protected].
We suspect a cyberattack. What should we do first?
Decide who leads the response and decides on blocking and communication. From now on, record every step with the time and check the notification duties in your cyber insurance policy. For a suspected account takeover, a new password is not enough: sessions, MFA methods, app consents and mailbox rules otherwise remain in place.
A mailbox is sending emails to customers that the employee did not write. What do we do now?
This points to a compromised sign-in. Block the account or reset the password without sending the new one by email, and revoke all sessions in the Entra admin centre. Then check authentication methods, app consents, mailbox rules, forwarding and the sign-in logs. Inform the customers who received the false emails.
What are the first steps after a ransomware attack?
Concentrate decisions, document everything with the time and involve your insurer and outside support early. Paying a ransom guarantees neither decryption nor that stolen data will not be published; agree the approach with your insurer and legal counsel. Recovery only works from backups the attacker could not reach.
Do we have to report a cyberattack?
That depends on the company and the incident. If you fall under NIS2, significant incidents require an initial report within 24 hours and a notification within 72 hours. If personal data is affected, the 72-hour deadline of the GDPR applies towards the data protection authority, and your cyber insurance policy has its own notification duties. This is not legal advice.
How do we prevent it from happening again?
After containment, the Security Assessment shows which gaps made the attack possible and what to close first. With managed security we then monitor your Microsoft 365 permanently and contain incidents within contractually agreed response times. On request we rehearse an incident plan with roles and reporting lines together with management and IT in a tabletop exercise.
No acute incident, but open questions?
In a 30-minute introductory call we clarify where your company stands and what to do first.