What to do when a company Microsoft 365 account has been hacked

How can you tell an account is compromised?

Rarely through anything dramatic. Usually through a detail that doesn't fit:

• "Sent Items" contains messages the employee didn't write;
• a client asks about an invoice or a new bank account you never sent;
• emails go missing, or new rules appear that move or forward messages elsewhere;1
• the account locks frequently or asks for a password change for no reason;
• a sign-in from another country, in the middle of the night.

Any of these is a reason to treat the account as compromised until proven otherwise.

What do you do in the first 15 minutes?

Four steps, in this order: tell whoever handles your IT, block the account, close the open sessions, and only then change the password.

1. Tell the person who handles your IT, straight away. Your IT support provider or your internal IT person. Don't wait to see whether anything else happens.

2. Block the account. Microsoft recommends disabling the account until the investigation is complete. It's temporary: the employee gets access back once the account is clean.1

3. Close the open sessions. The attacker can stay signed in on a browser or a phone even after the password changes. Signing the account out of every device is a separate step, done by whoever manages your Microsoft 365.1

4. Change the password. Only now, to a new one that hasn't been used anywhere else.

If there's nobody to do steps 2 and 3, at least do step 4 and get help within the hour.

What gets checked in the first hour?

The steps above stop the access. The checks below show what the attacker left behind. Whoever runs your IT does them. Your job is to ask whether they've been done.

• Rules and forwarding. Attackers often leave a rule that sends copies of emails to an outside address, or hides clients' replies.
• The phones that receive the confirmation code. Two-step sign-in asks for a code sent to a phone, on top of the password. If the attacker added their own phone, they can get back in.
• Apps the account has granted access to. An app approved by the attacker can keep reading email after the password changes.
• Admin roles. If the account had extra rights, check whether they were used.
• Sign-in history. Where and when the attacker got in, what they read, what they sent.

All of these are steps in Microsoft's procedure for a compromised account.1

Who do you tell?

Three groups: your finance team, the clients and partners who might have received fake messages and, where it applies, the authorities.

Your finance team, within the hour. Any recent request by email to make a payment or change bank details gets checked by phone, on a number you already had. A compromised mailbox is the usual route for fake invoices.

Clients and partners who might have received messages. A short email, from another account: "If you've received a payment request or new bank details from us in the last few days, please don't pay or change anything until you've called us."

The authorities, where it applies. There are two situations:

• Personal data was affected, your clients' or your employees'. The GDPR requires you to notify the data protection authority (in Romania, ANSPDCP) within 72 hours of becoming aware. The exception: when the breach is unlikely to result in a risk to the people whose data was affected.2
• Your company falls under NIS2 and the incident is significant. The early warning to Romania's National Cyber Security Directorate (DNSC) goes out within 24 hours. The deadlines are in our guide to who must comply with NIS2.

To find out whether either one applies to you, talk to your data protection officer or a lawyer.

What not to do

• Don't delete the account. After deletion, email and files are kept only for a limited time. Then they're gone, and you can be left without evidence. We explain why in our guide to the accounts of an employee who leaves.
• Don't delete the suspicious emails. They show how the attacker got in and what they sent.
• Don't pay anything requested by email until you've checked by phone.
• Don't re-enable the account before everything above has been checked.

The first-hour checklist

• Tell ITYour provider or internal IT person, straight away.
• Block the account, close sessions, change the passwordIn that order.
• Check rules, devices and appsWhat the attacker left behind.
• Tell financeAny payment request by email gets checked by phone.
• Warn clients who may have received fake messagesFrom another account, briefly.
• Check whether an authority must be notified72 hours under the GDPR, 24 hours under NIS2, where they apply.

What you can prepare in advance

Two things are best sorted out on a quiet day, not on the day of the incident.

Who can get into your admin accounts?

An admin account is the one used to change other people's passwords and hand out rights. Whoever gets into it doesn't have one employee, they have the whole company.

A recent example. On 30 October 2026, Romania's data protection authority fined a retail chain. Attackers had got into an administrator account and reached the names, email addresses and passwords of the company's users. The authority ordered that IT equipment be reachable only from the company's own network and, from outside, at least through a secure connection (VPN) combined with two-step sign-in.3

The question to ask whoever handles your IT: "Can our Microsoft 365 admin accounts be used from anywhere, on any computer?" A good answer is "no": they have two-step sign-in and can be used only from company computers.

What does your team do if email or invoicing stops?

At the end of October, a Romanian bookstore chain took its website and app offline as a precaution after a security incident. In its shops, vouchers, the loyalty program, invoicing, stock checks and orders stopped working. Cash and card payments carried on.4

This question is best asked in advance, not on the day: if email or your invoicing software doesn't work tomorrow morning, what can your team still do? Who has your key clients' phone numbers, how does an urgent invoice get issued, and who tells your partners. The answers, written on one page and kept on paper too, help on exactly the day the computers don't.

What the same incident looks like for a Risksoft client

So far we've described what a company does when it finds the problem on its own. For our clients, the steps in the first 15 minutes don't fall to you.

An example: someone signs in to an employee's Microsoft 365 account from another country, in the middle of the night. Identity detection flags the sign-in. Specialist analysts we work with watch alerts around the clock, confirm it really is an attack and stop it spreading: the account is blocked, open sessions are closed and the password is changed. Then we check the account for rules the attacker created.

On average, 8 minutes pass from the alert to the attack being stopped. Identity detection is one of the five layers of security included in the subscription.

Security rules that don't change how your team works, we switch on straight away. Those that do, such as opening company files only from office computers, we agree with you first.

We don't promise you'll never be attacked. The aim is that you don't hear about it from a client.

Frequently asked questions about compromised Microsoft 365 accounts

Is changing the password enough for a compromised account?

No. Changing the password doesn't close sessions that are already open and doesn't remove rules or apps the attacker added. The right order: block the account, close the sessions, change the password, then check rules, devices and apps.

Do I have to notify the data protection authority if an email account was compromised?

Usually yes, if personal data was affected: the GDPR requires notification within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the people concerned. For your exact situation, talk to your data protection officer or a lawyer.

How do I prevent Microsoft 365 accounts from being compromised?

Two-step sign-in on every account, identity detection that flags unusual sign-ins, and training so employees recognize fake emails. Two-step sign-in helps, but it isn't enough on its own: through a fake email, an attacker can get the password and capture the confirmation code too. With Microsoft 365 Business Premium, sign-in can be limited to company devices, so a stolen password and code are no longer enough. We explain the difference on our Microsoft 365 Business Premium page. None of these guarantees you won't be attacked, but together they greatly shorten the time until an attack is noticed.