A Business Email Was Compromised: Protect Customers, Suppliers and Payments

A compromised business mailbox can expose customer or supplier information, send convincing payment scams and disrupt normal work. Treat it as both an account-security issue and a business incident. Tell the person responsible for IT or security promptly, and coordinate changes so evidence is preserved and business services are not interrupted unnecessarily.

Protect payments immediately

If an employee sent money, shared bank details or received a request to change payment instructions, contact the bank or payment provider using a verified number. Ask whether a transfer can be stopped or recalled and how to secure online access.

Contact affected customers, suppliers and staff through a known phone number or separate channel. Ask them to pause unusual payment changes until independently verified. A familiar display name or an existing email thread does not authenticate new bank details.

Contain the mailbox with the administrator

Tell the administrator which mailbox is involved, when the issue began, what suspicious messages or alerts were seen, and what actions have already been taken. Depending on the mail system, the administrator may need to reset credentials, revoke sessions, disable unauthorised rules, secure recovery methods or temporarily block sign-in.

Ask the administrator to check forwarding, delegates, connected applications, app passwords, sign-in records, audit logs and message trace. Preserve original messages, headers and logs where possible. Check whether other mailboxes, administrator accounts, websites or shared services may also be affected.

Warn people who may have received fraudulent messages

Use a trusted communication channel to explain which messages or requests should be treated as suspicious and how recipients can verify future instructions. Do not include passwords, security codes or unnecessary personal information in a public notice. If an attacker changed payment details, state clearly that recipients should verify them using established contact details.

Assess possible information exposure

Work with the organisation’s privacy or legal lead to determine what information may have been accessed and which people or systems could be affected. Reporting duties depend on the type of information, who was affected and the jurisdictions involved. In Singapore, assess whether the incident is a notifiable data breach under current PDPC guidance; if it is notifiable, the PDPC says notification is due as soon as practicable and no later than three calendar days after the organisation determines it is notifiable.

Keep a record and close the access route

Maintain a timeline of alerts, messages, sign-ins, containment actions, people contacted and decisions made. After immediate containment, investigate how access was gained and whether other accounts were reached. Before closing the incident, confirm that unauthorised access has been removed, recovery details are correct, multifactor authentication is in place where available, and payment-verification procedures are clear.

If you need help investigating a compromised hosted mailbox, contact Cyber Damage Control to discuss your hosting setup and the access available to your provider.

Official guidance

Singapore PDPC: required to notify the PDPC — https://www.pdpc.gov.sg/required-to-notify-the-pdpc

Australian Cyber Security Centre: recover from business email compromise — https://www.cyber.gov.au/guidance/recover-from-business-email-compromise

CISA small and medium business resources — https://www.cisa.gov/small-and-medium-business-resources