Stop Unauthorized Access
Find Out What Happened
Secure Your Business
WHAT TO DO RIGHT NOW
Act quickly, but avoid destroying important evidence.
If you believe a business email account has been hacked, contact your IT provider through a trusted phone number or an unaffected email account. Do not continue using the suspected account or assume that changing its password will remove every form of unauthorized access. Take note of when the suspicious activity was discovered and preserve any unusual messages, warnings or payment requests. If emails were sent from the account, notify affected employees, customers or suppliers through another trusted communication method.
Contact your IT provider using a trusted number
Stop clicking links, opening attachments or replying
Preserve screenshots and suspicious messages
Warn affected contacts through another channel
CONTAIN. INVESTIGATE. RECOVER.
Changing the password is only the beginning.
An attacker may still have an active session, an unauthorized multifactor authentication method, hidden email rules, external forwarding or access through a connected application. A proper response should remove that access, determine what happened and identify who may have been affected. NCDS CANADA Inc. can help investigate and secure compromised Microsoft 365 business accounts. We focus on containing the incident, restoring trusted access and reducing the possibility of the attacker returning.
Disable or restrict the compromised account
Revoke active Microsoft 365 sessions
Review multifactor authentication methods
Find forwarding and hidden inbox rules
Review sign-ins, audit activity and sent messages
Secure the account and recommend improvements
You do not need to be an existing managed-services customer to start a conversation. We will first review the situation and explain whether NCDS can assist.
EMAIL HACKED? ACT NOW.
Get help before the incident spreads further.
If someone has accessed your business email, sent unauthorized messages or changed your account settings, acting quickly can help limit the damage. Call NCDS using a trusted phone or contact us from an email account that is not affected.
Tell us what happened, when you first noticed it and whether suspicious messages, payment instructions or files were sent.
Important note:
Do not contact us from the suspected email account. Incident assistance is subject to availability and an initial review.