Compromised Microsoft 365 mailbox: contain, verify, report.

Contain (Microsoft 365 administrator)

1. Disable the account or reset the passwordDisabling is preferred. Don’t send the new password by email; app passwords aren’t revoked automatically.
2. Revoke sessionsSign out every active session of the account.
3. Remove unknown MFA methods and devicesThen enable and enforce multifactor authentication.
4. Review consented appsRemove consents granted to unknown apps.
5. Review admin rolesA compromised account must keep no unnecessary role.
6. Examine forwarding and rulesEvery mailbox forward and every rule, including hidden ones; delete what isn’t legitimate. If sending was blocked, then remove the user from restricted entities.

In parallel (management)

1. Call the bankIf a payment to the attacker has gone or is scheduled: ask to stop or recall it, with date, amount and IBAN.
2. Warn customers and suppliersBy phone, on a known number: invoices and bank details received from your addresses may be fake.
3. Keep the tracesScreenshots of rules and forwards before deletion, headers of the fraudulent emails, a timed log of actions.
4. Assess the reporting dutiesPersonal data: FDPIC if a high risk is likely. Critical infrastructure: NCSC within 24 hours. These are assessments, not automatic rules.

What not to do

• Don’t reply to the attacker or warn them of your actions.
• Don’t send the new password by email.
• Don’t delete rules and messages before documenting them.
• Don’t assume one universal deadline: the Swiss FADP, the GDPR and the critical-infrastructure duty differ in threshold and timing.

Signs of a compromised mailbox (Microsoft’s list)

• The mailbox is blocked from sending, or email disappears.
• Inbox rules forward to unknown addresses or move messages to Notes, Junk or RSS.
• Suspicious items in Sent Items or Deleted Items.
• Frequent password changes or unexplained lockouts.
• Recently added external forwarding, a changed signature.
• Customers receive an invoice with new bank details.

The legitimate options

• Microsoft’s procedure

  The Microsoft Learn page details each step and the related admin commands.

• Report to the FDPIC (FADP, art. 24)

  For a data security breach likely to lead to a high risk, “as quickly as possible”. With your consent, the FDPIC may forward the report to the NCSC.

• GDPR, if it applies to you

  Notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours”, unless the risk is unlikely.

• Critical infrastructure (ISA)

  Operators concerned report certain cyberattacks to the NCSC within 24 hours of discovery, since 1 April 2025.

• Voluntary NCSC report and complaint

  For any company; a police complaint in case of fraud.

When a specialist helps

• You no longer have administrator access to the tenant.
• A payment was diverted or other mailboxes seem affected.
• Customer, patient or employee data is involved.
• You don’t know the entry point and fear persistent access.
• An insurer, a customer or an authority expects a written report.