A real hack at a client, explained step by step. What went wrong, and what you can do today to avoid it.
Because of the daily rush or for financial reasons, it's tempting to postpone investments in cybersecurity. But what if it concerns your company data, your reputation and, in extreme cases, the survival of your business? Postponing can carry a risk you underestimate. That's why we share the key insights from a recent hack at one of our clients.
From the field An employee receives an email from a client asking him to open a document on OneDrive. He logs in with his Microsoft 365 credentials, but it doesn't work. His colleagues can't get in either. What happened? It was a phishing email. Our systems detected risky activity on the account, which led us to investigate in depth.
Our analysis showed that someone had successfully logged in to the account from Asia. Nobody at the client was abroad, yet two-step verification had also succeeded from abroad. The account had been hacked. Through social engineering, the attackers had obtained the two-step verification code. So even that extra layer of security wasn't enough.
After a thorough reconstruction, we found that a member of management had received an email from a client with a link to a document in OneDrive. He forwarded the email to a colleague, who, together with other colleagues, tried to log in with their Microsoft 365 credentials. That gave the attackers access to the Microsoft 365 environment, and they exploited sensitive files, including an Excel file with passwords.
As soon as we detected the intrusion, we blocked all access. The damage stayed limited, partly because all passwords from the Excel file were reset immediately.
The attackers used a common method: social engineering. They mislead people through psychological manipulation, so that they share confidential information or take certain actions. Here they sent a simple, convincingly real email through our client's client, with a link to a fake website. That client's account had been hacked as well. The goal: make employees believe they were on a legitimate site, so they would enter their credentials.
When several employees entered their details on the fake website, the attackers gained access to our client's environment. That allowed them to search specifically for documents with sensitive information, and to cause damage such as:
Fortunately we caught it in time. But the damage could have been considerable.
You can arm your IT environment to the teeth technically, but the weakest link gets attacked first: people. Invest in regular training, for employees and management alike, to build a security-aware culture.
Managers are not immune, quite the opposite. They are often a first target and need to be extra vigilant.
You don't control the IT environments of your clients and suppliers. Here the fake link actually came from the email address of a client whose environment had also been hacked.
Storing passwords in an Excel file is risky. A password manager generates and stores strong, unique passwords, as well as two-step verification codes and passkeys.
Links from legitimate email addresses can also be misleading. Don't take any risks, regardless of the source. When in doubt, contact your IT partner and teach your colleagues to do the same.
Always check the web address before you log in. Phishing sites often use subtle differences, such as spelling mistakes.
Choose a partner that actively monitors your environment, detects threats quickly and intervenes immediately to limit damage.
The attackers used social engineering via phishing to gain access to sensitive information, including passwords. By building these lessons into your company culture and your security, you prevent such an attack or limit the damage.
In short
Attackers target people, not systems Management is the first target Passwords in an Excel file: never do it
The information in this article is intended as general knowledge about using Apple products in a professional environment. Your organisation may have its own policies that restrict certain features or software. Always consult your organisation's IT policy before changing anything on company hardware or software.
