Incident response: when the email environment is compromised
A mailbox suddenly sends phishing, customers receive forged payment requests, an unknown file sits on the Exchange server, or the mail gateway vendor reports an exploited vulnerability. In such situations I support containment, analysis and remediation, with a focus on the mail and identity layer.
- Incident Response
- Business Email Compromise
- Microsoft 365
- Exchange Server
- Mail Gateways
- Reporting Obligations
Typical cases
- Compromised mailbox (BEC)Unknown sign-ins, hidden inbox rules, external forwarding, stolen session tokens and payment fraud through genuine accounts.
- Attacked Exchange serverExploited vulnerabilities on on-premises Exchange: Webshells, manipulated configuration, new accounts or permissions, exfiltration of mailbox content.
- Vulnerability in the mail gatewayZero-days in gateways such as FortiMail or Kiteworks: implement the workaround, check for compromise, plan the return to service.
- Abuse of your own domainForged mail in your company’s name, loss of reputation and blocklists: establish the origin, close the authentication gaps, request delisting.
What happens in an incident
- ContainRevoke sessions and tokens, reset passwords and MFA, remove malicious rules and forwarding, isolate affected systems without destroying evidence.
- Preserve evidenceSecure the Unified Audit Log, sign-in logs, Message Trace, server and gateway logs before retention periods delete them.
- AnalyzeReconstruct the entry point, time frame, affected accounts and messages that were read, sent or exfiltrated.
- Remediate and hardenClose the root cause, clean up the configuration, extend monitoring; final report for management, insurer and authorities.
Reporting obligations in Switzerland
If an incident affects personal data and is likely to result in a high risk for the data subjects, the Swiss Federal Act on Data Protection requires notification to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible (Art. 24 FADP). Since 1 April 2025, operators of critical infrastructure must report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours. I provide the technical basis for these reports; the legal assessment remains with you or your legal counsel.
Real-world examples
- FortiMail zero-day CVE-2026-104286: workaround and compromise assessment.
- Kiteworks: vendor recommends shutdown: what to do about an exploited gateway vulnerability.
- CVE-2026-62911: Exchange NTLM relay: attack path and countermeasures for on-premises Exchange.
- Analyzing Exchange message tracking: the tools to reconstruct mail flow after the fact.
- CVE tracker: vulnerabilities in mail and messaging products, updated daily.
