An employee clicked a phishing link: what do you do in the first hour?

Niamh’s PC is off. The attacker is not.

The password went to a web page, not to the PC. Whoever has it is signing in to Microsoft 365 from somewhere else entirely.

Her mailbox, the client files she can open in SharePoint, her Teams chats: all still open to them, from any device they like.

Signed-in sessions and the tokens behind them carry on until someone revokes them. Nothing on Niamh’s desk can do that.

And switching off threw away what the PC could have told you about the link, the page and the time.

A cloud account is secured in the cloud: reset the password and sign the account out everywhere.

Niamh changes her password at her desk and goes back to work, quietly.

She doesn’t mention that the page also asked for the code from her authenticator app, and that she typed that in too. She doesn’t want to look stupid twice.

Nobody checks whether the attacker is still signed in. They are.

By lunchtime the whole office knows Niamh “got hacked”. The next person who clicks something will say nothing at all.

The NCSC is blunt about this: blame and punishment don’t stop people clicking, they stop people reporting. The people who report quickly are your early warning.

You tell Niamh she did the right thing. You mean it.

You write down three times: when the email arrived, when she typed the password, and when she told you.

Then you ring the people who look after your Microsoft 365 and say the words that get things moving: “We have a compromised account. Now.”

Dara, your practice manager, starts a note of everything that happens from here. You’ll need it.

The password changed on Tuesday. The attacker kept reading until Thursday.

Signed-in sessions don’t end when a password changes. Until they are revoked, the apps and browsers already signed in keep working.

And a hidden inbox rule was quietly forwarding every email with “invoice” or “payment” in the subject to an outside address.

Niamh never asked. The attacker did, from her address, with her signature.

Sent items look clean. That’s the problem.

Attackers delete what they send, and they move the replies out of sight with rules the user never sees.

Microsoft’s own write-up of this kind of attack describes exactly that: a rule that archives and marks as read every reply from the people being defrauded, and the sent messages deleted.

A clean-looking mailbox tells you nothing. The logs do.

In twenty-five minutes, the account is yours again.

Reset. A new password, and not sent to Niamh by email, because the attacker could still be reading it.

Revoked. Every signed-in session ended. The attacker’s browser is signed out, wherever it is.

Removed. One hidden inbox rule found and deleted: anything with “invoice” in the subject was being forwarded to an outside address.

Re-registered. Her MFA methods are checked and set up again, so any phone the attacker added is gone, and consented apps are reviewed.

Dara writes down each step and the time it was done.

There it is. A successful sign-in at 9:14, from a country Niamh has never been to.

The page Niamh used wasn’t just a copy of the Microsoft sign-in. It sat in the middle, passing her password and her code straight through in real time, and kept the signed-in session at the end.

Microsoft has described campaigns like this against more than 10,000 organisations. The stolen session carries the MFA claim, so the attacker never needs a code again.

Codes from an app, codes by text and “Approve” buttons can all be relayed this way. Passkeys and security keys can’t: they only work with the genuine site.

Her account is a key to far more than her inbox.

Anything Niamh could open, the attacker could open: the client folders in SharePoint, her OneDrive, the Teams chats where people share files and the odd password.

The audit log shows files being opened in the Clients – Payroll library at 9:31. Twenty client payroll files, with names, addresses and bank details.

That is personal data, and it changes what you have to report.

Eleven emails left Niamh’s account at 9:26. None of them is in sent items.

Each one went to a client, with the same “shared invoice” link she clicked. The attacker deleted them as they went.

Two clients have already clicked.

Phishing spreads along trust. The clients trusted Niamh’s address because it really was Niamh’s address.

One of the clients whose payroll file was opened asks you a direct question.

You never assessed it, never wrote it down, never told them. The ICO’s 72 hours ran out on Friday morning.

Failing to notify the ICO when you should have can mean a fine of up to £8.7 million or 2% of turnover. The bigger cost is the client who now knows you kept quiet.

And because nobody reported the crime, nobody is looking for the people who did it.

The investigation finishes on Saturday. The ICO’s 72 hours ended on Friday morning.

The clock starts when you become aware, not when you understand. You don’t need the full picture: the ICO lets you report what you know and send the rest in phases.

Your cyber insurer hears about it on Monday. The policy expected to hear at once, and to have its own response team involved. Check those conditions before you need them.

The eleven clients who were emailed from Niamh’s address found out from the phishing email itself.

Four calls, one form, one email, and all of it written down.

Your insurer is told at 2:30. They want their own incident team involved, which is fine: it is what the policy is for.

The phishing email goes to the NCSC at [email protected]. The crime goes to Report Fraud, which replaced Action Fraud for England, Wales and Northern Ireland in January 2026.

The eleven clients get a short, honest email and a call: the “shared invoice” from Niamh’s address this morning was not from Niamh; don’t open it; here’s what to do if you did.

The ICO’s question: twenty payroll files with bank details, opened by a criminal. A risk to those people is likely. You report it with what you know, and say more will follow.

Dara’s note has every call and every decision, with a time against it.

Everyone knows it’s serious now. So nobody reports anything.

A trainee clicks a “parcel delivery” link on a firm laptop, sees a blank page, and closes it. He tells no one. The account is used for three weeks before a client notices.

Niamh, who reported hers inside half an hour, hands in her notice.

The NCSC says it plainly: no one can be expected to spot every phishing email, and punishing people for clicking stops them telling you.

The office has its own version of events, and it’s worse than the truth.

Two people who got the same email still haven’t said so, because they aren’t sure it matters.

One of them clicked it.

Rumour fills a gap. The gap was yours to fill.

Three hands go up. Two had the email. One clicked, and typed nothing.

That one is checked anyway: sign-in log clean, nothing to do. It takes five minutes to be sure.

You put the email on the big screen: the real client’s name, the wrong address, the “sign in again” page. Then you show everyone where to send the next one.

Short, real, no telling-off. Retraining, not discipline, because the lesson is the same for all fifteen of you.

Niamh is still here. She’s the one who caught it.

The course is good. The next phishing email is better.

Training raises the odds that someone spots it. It never gets them to zero, and your firm gets hundreds of emails a day.

The NCSC’s guidance treats training as one layer of four: make the emails harder to deliver, help people spot and report them, limit what a click can do, and respond fast. Some attacks will always get through.

A password typed into a look-alike page, and a code typed after it, is a problem no course solves. The fix has to be in the sign-in itself.

The next look-alike page simply asks for the text-message code as well.

Codes by text, codes from an app and “Approve” buttons share a weakness: a person can be talked into handing them to the wrong page, in real time.

The NCSC ranks message-based codes last: for when nothing stronger is possible.

Phishing-resistant MFA, such as passkeys and security keys, works only with the genuine site, so a look-alike page gets nothing it can use.

Five lines. Each one would have changed Tuesday’s story.

Phishing-resistant MFA (passkeys or security keys) for everyone, so the look-alike page gets nothing it can use.

Conditional access, so a sign-in from an unknown device or an unexpected country is refused, however it was authenticated.

EDR on every computer, so a click on a bad link is seen and stopped, and there is evidence afterwards.

Mail filtering and DMARC, with SPF and DKIM, so look-alike senders are caught and mail pretending to be from your domain is rejected by everyone who receives it.

A plan with names and numbers on it, rehearsed once a year, so the first five minutes aren’t improvised.