What Happens When a Microsoft 365 Account Is Compromised?

When a Microsoft 365 account is compromised, an attacker can potentially access a genuine employee account, read emails and conversations, understand how the business operates and use that trusted identity to target colleagues, customers or suppliers.

One of our customers recently experienced exactly this after an employee entered their Microsoft 365 password and MFA details into a convincing fake sign-in page. From the employee's point of view, there was no obvious sign that anything serious had happened.

This article follows what happened next, how the activity was isolated and contained - but importantly it highlights what the attacker could potentially have done and what other businesses can learn from it.

In the video below, I caught up with Sasha Roshan from Huntress to talk through the incident in more detail, including what the business could have done differently and the five practical things Sasha believes every SME should have in place.

To keep up to date with the latest cybersecurity news, threats and trends, follow The HBP Group on LinkedIn and Sasha across his social platforms. 

If you would rather read the story, we have broken down the incident and the main takeaways below.

A Real SME Cyber Attack And What Businesses Can Learn From It

What Actually Happened?

The employee involved was a sales manager who received an email about a PDF that somebody was apparently having trouble sending to him.

It looked believable enough that he followed the link, which eventually took him to what appeared to be a genuine Microsoft sign-in page.

He entered his Microsoft 365 email address and password and then completed the MFA request presented to him.

From his point of view, he had followed what looked like a normal Microsoft sign-in process. In reality, somebody was on the other side collecting that information and using it to access the genuine Microsoft 365 account.

There was no obvious malware download and no ransomware suddenly appearing on the computer. The fake page could simply appear not to work, show an error or lead nowhere once the information had been submitted.

So the employee carried on with his day.

From Microsoft's point of view, somebody appeared to be accessing the account using valid credentials and had completed the authentication step they had been asked for. On the surface, the attacker therefore looked much more like the genuine employee than somebody obviously trying to break into an account.

That is what makes this type of attack difficult to spot. The employee can believe that nothing happened while the attacker already has what they need.

We also do not know exactly how long the attacker had access to the account before the suspicious activity was detected.

From the investigation afterwards, there appears to have been a period where they were inside the account without doing anything particularly obvious. The sales manager was also preparing to go away on annual leave for more than a week.

It is possible the attacker had seen emails, Teams conversations or his out-of-office and knew he was about to be away. We cannot say for certain that they deliberately waited for that moment, but we do know that more suspicious activity began as the employee was leaving for his holiday.

How Was It Spotted?

When the attacker accessed the account again, their behaviour did not fit what would normally be expected from the genuine employee.

The account appeared to be signing into Microsoft 365 from the United States while the employee himself was in the UK preparing to go on holiday. Shortly afterwards, inbox forwarding rules also started being created.

Those behaviours were picked up and investigated.

The account was locked down, active sessions were revoked, the password and MFA were reset and the suspicious changes were stopped while a human analyst investigated what had happened.

When the employee returned from holiday more than a week later, the account could be safely restored and, most importantly, no data had been lost.

This is where detection and response become important. It is not only about whether somebody knows the correct password. Modern identity monitoring can also look at things such as where somebody is logging in from, the device and operating system they are using, their IP address, VPN activity and whether that behaviour fits what would normally be expected from that user.

What Could Have Happened?

Had the activity gone unnoticed, the attacker could potentially have accessed the employee's emails, shared mailboxes, SharePoint, OneDrive, Teams conversations and other information available through their Microsoft 365 account.

Stealing information, however, is not always the immediate goal.

Access to a genuine employee account can tell an attacker a huge amount about how a business operates. They can start to understand who deals with suppliers, who approves payments, which customers the employee regularly speaks to, how senior people communicate and when key members of staff are away.

Sasha explained in our conversation that attackers will sometimes spend time inside an account doing exactly that before deciding what to do next.

For example, if an attacker can see an existing conversation about an invoice, they could potentially continue that conversation from the genuine employee's account and introduce new bank details. They could send a malicious document to somebody who already trusts the sender, or use the compromised account as a foothold to reach another organisation.

Because the message is coming from a genuine account and could continue an existing conversation, it can be considerably harder for the recipient to recognise that anything is wrong.

This is also why an attacker may not act immediately. They may spend several days learning how the business communicates, looking for a better opportunity or waiting for the right moment. Their eventual objective can even change depending on what they discover once they are inside.

What Could A Cyber Attack Like This Cost A Typical SME?

There is a reasonable question businesses ask when considering whether to invest more in cybersecurity: would dealing with an incident actually cost more than putting additional protection in place now?

Nobody can say exactly what this particular incident would have cost if it had been allowed to develop. It could have resulted in relatively little, or it could have led to financial fraud, stolen information or a much wider incident that disrupted the business for several days.

Even looking at disruption alone shows how quickly the impact can build.

Take a business with:

• 25 to 50 employees
• £1 million annual turnover
• Around 250 working days per year

That works out at approximately £4,000 of normal turnover for every working day.

If a serious cyber incident disrupted the business for five working days, that is a period in which around £20,000 of normal business activity would ordinarily have taken place.

There is also the impact on employees. Five days of serious disruption represents:

• 125 employee working days for a 25-person business
• 250 employee working days for a 50-person business

That is before considering IT investigation and recovery costs, senior management time, delayed customer work, missed orders, supplier disruption, fraudulent payments and regulatory requirements.

Then there is the reputational damage, which can be much harder to recover from, particularly if a breach puts accreditations or customer contracts at risk in sectors where security is critical, such as defence, government, healthcare, financial services and critical infrastructure.

UK Government research published in 2025 estimated the average cost of a significant successful cyber attack at almost £195,000 per affected UK business, although that covers organisations of different sizes and sectors and should not be treated as a prediction of what an individual SME would lose.

The point is not that every cyber attack will cost hundreds of thousands of pounds. It is that the longer an attacker goes unnoticed and the further an incident develops, the harder and potentially more expensive it becomes to deal with.

Could This Have Been Prevented?

There is no single security control that can guarantee an attack like this will never happen.

MFA still matters. Antivirus still matters. Firewalls, strong passwords and good Microsoft 365 security settings all still matter.

The issue is assuming that because those things are in place, nothing else can get through.

In this incident, the employee entered both their Microsoft 365 credentials and the authentication information requested by the fake page. The attacker was not simply trying to guess a password. They were trying to make their access look like a genuine sign-in.

As Sasha explains in the video, businesses need different layers of protection. Preventative controls make an attack harder, while detection and response give you another opportunity to identify suspicious behaviour if something does make it through.

That can include Endpoint Detection and Response, or EDR, on devices and Identity Threat Detection and Response, or ITDR, around Microsoft 365 accounts and identities.

The human side is just as important. Phishing works because it is designed to be believable, and somebody who is busy, travelling or trying to finish work before a holiday can make a perfectly understandable mistake.

Rather than expecting employees never to click something they shouldn't, businesses need regular security awareness training and a culture where people feel comfortable reporting something as soon as it does not feel right.

If somebody can say, “I think I've clicked something, can you check it?”, that gives the business an opportunity to investigate while there is still time to do something about it.

Senior leaders play an important part in creating that culture. Employees need to know that reporting a genuine mistake quickly is encouraged, rather than something they should hide because they are worried about getting into trouble.

The Top Five Cyber Security Measures Every SME Should Have In Place

At the end of our conversation, I asked Sasha to imagine walking into a business with 20, 50 or 100 employees and starting with a blank sheet of paper.

If he could choose five things that business should have in place, these were his recommendations.

1. Get Your Microsoft Configuration Right

Start with the fundamentals and make sure your Microsoft environment is configured properly for the way your business operates.

That includes having MFA enabled, using phishing-resistant authentication where appropriate, reviewing your wider Microsoft security settings and making sure you have the right Microsoft licensing in place to support the protections you need.

MFA remains an important security control. As this incident demonstrates, though, it should be one part of a wider approach rather than something a business assumes makes an account impossible to compromise.

2. Know What Is In Your Environment

Businesses pick up devices, servers, applications and other technology over time, and it is easy for something to be forgotten.

Keeping an inventory means you know what is there and can make sure systems are receiving the latest patches and updates.

A server that has been running quietly for years without causing a problem can still become a security risk if nobody realises it is no longer being properly maintained.

3. Have Detection And Response In Place

Sasha specifically highlighted both Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR).

Preventative security is still important, but businesses also need to know when something suspicious is happening and have the ability to respond when something gets through.

This incident is a good example of why that matters. The attacker had valid credentials, but their behaviour once inside the account did not fit the genuine employee.

4. Provide Regular Security Awareness Training

Your employees are one of the first lines of defence when an email reaches their inbox.

Sasha recommends keeping training regular and relevant rather than relying on one longer session each year. The threats people are facing continue to change, so the training they receive needs to change with them.

That should also include giving employees a simple way to report something when they are unsure rather than expecting them to make every security decision themselves.

5. Test Your Security And Incident Response

Having an incident response plan is useful, but you also need to know whether it would actually work if you had to use it.

Sasha recommends having appropriate backups in place, understanding who would do what during an incident and regularly testing how the business would respond.

That can include tabletop exercises where you work through a realistic cyber incident and see how the people, technology and processes in the business would actually cope.

Testing those things in advance gives you an opportunity to identify gaps before a real attack finds them for you.

What Should Businesses Take From This?

This incident does not mean antivirus has failed, MFA does not work or employees cannot be trusted.

Those controls are still important. The lesson is that no single control can cover every possible way into a business.

You should absolutely do everything sensible to make it difficult for an attacker to get in, but your cybersecurity also needs to account for the fact that people make mistakes, attackers change their techniques and sometimes something will make it through.

What matters then is whether anybody notices, how quickly they can act and whether your business knows what to do next.

How The HBP Group Can Help

If you're already a customer of The HBP Group and this story has made you question how your own business would respond, speak to your Account Manager or get in touch.

You can also explore the additional protection included within our elevate Security and elevate Security+ packages here: Explore our elevate Security packages →

If you're not sure where to start, that's absolutely fine. We can talk through the cybersecurity you already have, understand what is currently in place and help you identify where there may be gaps.