IT ISSUE · SECURITY AND THREATS
Compromised account
An account may have been taken over. Below are the checks that matter and the point at which this needs a specialist.An account that gets taken over is usually not the one somebody uses every day. It is more often the one nobody does: a person who left, a shared login from a project that finished, a mailbox opened for a season and never closed. Those accounts keep all of their access and lose the only person who would have noticed.
What you may notice
- Sign-ins from places nobody works.
- A mailbox rule forwarding messages somewhere nobody chose.
- Colleagues receive email you didn't send.
- An MFA prompt arrives when nobody is signing in.
- A password stops working that nobody changed.
The account is the symptom. The gap is usually older.
We review the affected account, its recent sign-in activity, its mailbox rules and its registered MFA methods. Where we're permitted, we work through the practical containment steps.
Then we look at how it stayed open: who owned it, which departure or finished project should have closed it, and what else from that same period is still active.
We don't investigate breaches. Where this needs a specialist, a legal adviser or your insurer, we say so early and coordinate with them rather than stretching to cover it ourselves.