Scenario 03 Illustrative
Compromised Mailbox at an Accounting Firm
An illustrative case of a phished partner mailbox at an accounting firm in tax season: containment, warning clients and phishing-resistant MFA.
Illustrative scenario, not a client engagement. This is a hypothetical example based on common attack patterns. It shows how we'd approach the problem, and doesn't describe a real client, incident or result.
- Sector
- Accounting
- Scenario
- Email compromise
- Written for
- Leadership and IT teams
The situation
In the middle of tax season, clients of a 40-person accounting firm start calling. They've received emails from one of the partners asking them to upload tax documents to a new “secure portal”. The emails came from the partner's real mailbox.
A week earlier, the partner entered their password, and approved a sign-in prompt, on a convincing fake Microsoft 365 login page. Since then, the attacker has been reading their email, quietly hiding replies with inbox rules and harvesting client information.
What's at stake
The risks
- Client tax files contain Social Insurance Numbers, income and banking details: exactly what identity thieves want.
- Clients who trust the firm's email may send documents or money straight to the attacker.
- The firm may have to report the breach and notify the clients affected.
- A professional reputation built over decades could be damaged in a week.
Our approach
How we'd help
- Contain. Revoke the attacker's sessions, reset credentials, remove malicious inbox rules and app connections, and block the fake portal.
- Scope. Use audit logs to establish what the attacker read, sent and downloaded, and check whether other accounts were compromised.
- Notify. Support leadership and legal counsel in assessing notification obligations, and help draft clear, timely warnings to clients.
- Prevent. Move to phishing-resistant MFA, tighten sign-in policies, alert on suspicious mailbox changes and give clients a genuine secure portal.
Decisions for leadership
- Warn clients quickly. Speed stops further fraud, even before the investigation is complete.
- Decide, with legal advice, whether the breach must be reported to the privacy commissioner and the individuals affected.
- Consider offering affected clients credit monitoring.
- Fund phishing-resistant MFA for partners and anyone with access to sensitive client records.
Technical notes
- Adversary-in-the-middle phishing kits proxy the real login page and steal session cookies, defeating push and one-time-code MFA.
- Resetting the password doesn't end existing sessions on its own. Revoke refresh tokens and sign-in sessions too.
- Hunt for inbox rules that move or delete messages, MFA methods registered by the attacker, OAuth consents and sign-ins from hosting providers.
- Mailbox audit events such as MailItemsAccessed, where your licence records them, show which messages were read.
- Consider requiring compliant devices or token protection for access to email and client files.
The takeaway
MFA isn't a finish line. Phishing-resistant sign-in and fast detection of mailbox tampering are what stop this attack.
Related reading
Next step
Could this happen to you?
Tell us what you're protecting. We'll help you find the gaps before an attacker does, and plan how you'd respond if one gets in.
Book a consultationPrefer to talk?