Business Email Compromise Response
Hacked Business Email? Act Fast, and in the Right Order.
Business email compromise (BEC) happens when an attacker takes over or impersonates a business email account to steal money or data. Gipson Cyber’s business email compromise response contains the account, finds out what the attacker saw and did, and helps you protect your clients, your payments, and your reputation.
We work alongside your IT team or MSP, and with your bank, insurer, and counsel when they are involved.
Signs of Email Account Compromise
What to Do Right Now if Your Business Email Is Hacked
- If money was sent, call your bank right away and ask about recalling the payment. Hours matter.
- From a device you trust, reset the account password and sign the account out of all sessions.
- Turn on or reset multi-factor authentication for the account.
- Do not delete the attacker’s emails or messages. Screenshot any suspicious inbox rules before you remove them. This is evidence.
- If you have cyber insurance, call your carrier’s claim hotline.
- Report wire fraud to the FBI’s Internet Crime Complaint Center at ic3.gov.
- Then get help from an incident response team at 800cyber.com.
Our Business Email Compromise Response
Email compromise response is part of Business DFIR, our small business incident response service.
Contain
Lock down the compromised account, end attacker sessions, remove malicious rules and app access, and check whether other accounts are affected.
Investigate
Review sign-in and mailbox activity to build a timeline of what the attacker accessed, sent, and changed, and how they got in.
Scope the Exposure
Identify which messages, attachments, and contacts may have been exposed, so you and your counsel can make informed notification decisions.
Recover and Report
Work with your IT team or MSP to close the entry point and strengthen email security, then deliver a plain-English report for leadership, insurers, and counsel.
Reduce the Odds of the Next One
Many email compromises start with a phishing message or a reused password. Our SOCaaS for small business includes email and browser phishing prevention, staff security-awareness training, phishing simulation tests, and user activity and location tracking watched by our analysts 24×7.
Read how one phishing email turned into tax fraud for 300 clients: Spear phishing tax fraud attack on a solo accountant.
Business Email Compromise: Common Questions
Is a hacked email account a data breach?
It can be. If the mailbox held personal, financial, or health information, notification laws may apply. Whether they do is a question for your counsel. Our job is to give your counsel accurate facts about what was accessed.
Can you get back money that was wired to an attacker?
No one can promise recovery. Your bank is the first call, and acting within hours rather than days gives you the best chance. We document the timeline and evidence your bank, insurer, and law enforcement are likely to ask for.
Do you handle Microsoft 365 and Google Workspace?
Yes. We investigate and respond to email account compromise in both Microsoft 365 and Google Workspace.
Do you work with our IT provider or MSP?
Yes. Your IT team or MSP knows your environment. We bring the investigation and containment experience and coordinate with them from the first call.
Think your business email has been compromised?
Reach our responders now. For prevention or planning, schedule a consultation.