Question 1

We've just paid a fraudulent invoice — can we get the money back?

Accepted Answer

Sometimes yes, if you act within hours. UK Faster Payments to a fraudster is APP (Authorised Push Payment) fraud. Call your bank's fraud team immediately, say 'APP fraud' and ask them to consider the Contingent Reimbursement Model (CRM) — the Payment Systems Regulator's framework that obliges banks to reimburse APP fraud victims in many cases. Time is critical — banks sometimes manage to reverse funds before the recipient pulls them out.

Question 2

I reset the password — are we safe now?

Accepted Answer

Probably not. Password reset doesn't revoke active sessions, malicious Inbox rules, OAuth grants, or mailbox delegates that the attacker set up. Many firms that 'secured' themselves with a password reset discover two weeks later that the attacker continued reading mail the entire time. Enable sign-in block, then audit and remove persistence, then reset password — in that order.

Question 3

What are malicious Inbox rules and why do they matter?

Accepted Answer

An attacker who controls a mailbox can create rules like 'whenever an email arrives with invoice in the subject, forward it to <their address> then move to Deleted Items'. The user never sees these — Microsoft doesn't notify. Common hidden-rule names include '.', '..', 'RSS feeds', 'Updates'. We perform a mailbox audit log search across the affected mailbox specifically for rule creation events in the past 90 days.

Question 4

Does an email compromise need to be reported to the ICO?

Accepted Answer

Almost always yes. Mailbox compromise typically exposes personal data — contacts, employment correspondence, contract details, sometimes special category data. ICO notification is required where the breach is 'likely to result in a risk to individuals' — which mailbox compromise usually is. We help you document the risk assessment and (if required) draft and file the ICO submission. See our ICO breach notification consulting.

Question 5

Will my customers find out?

Accepted Answer

Possibly. If the attacker sent mail as you (impersonated the firm to suppliers or customers), those recipients may already be aware because they received the malicious mail — they may have paid the hacker themselves. Proactive, controlled communication to affected counterparties is usually safer than waiting for them to come to you. We help you draft these comms carefully to limit liability and protect trust.

Question 6

Will the attacker come back?

Accepted Answer

Often yes. BEC attackers try to set up OAuth grants so that they keep mailbox access even if you reset the password — a one-line consent click can grant a malicious app long-term access. Without a full eradication pass (rules + grants + sessions + admin account resets), the persistence will outlive your reset and the attacker will be back within weeks. Our eradication workflow covers all of these.

Question 7

We have a small IT team — can we do the eradication ourselves?

Accepted Answer

If your IT team is comfortable in the Microsoft 365 admin console and Entra ID, you may handle parts in-house. The risk is when IT teams treat password reset as 'done' — persistence is missed. We can either run the full eradication (recommended) or pair with your IT team: we hunt persistence, your team implements the agreed clean-up actions. Pricing scales accordingly.

Your Email Inbox Has Been Hacked. What now.

Do these 4 things in the next 10 minutes

What we do — the Gridisys incident timeline

Containment (Hours 0-4)

Scoping & ICO threshold (Hours 4-24)

Eradication & hardening (Days 2-7)

Recovery & supplier communication

What it costs

What we cover

Frequently asked questions

Talk to us now