Your Data Breach Response Plan: Days Two Through Five After an Email Compromise

Somebody in accounting clicks a convincing sign-in link. The attacker reads that mailbox for a few weeks, learns who pays which vendors, and sets up a rule that quietly forwards anything with “invoice” in the subject. When a big progress payment comes due, the vendor’s “new bank details” arrive from a lookalike domain, and the money goes out. You find out when the real vendor calls asking where their payment is.

The first day is mostly technical: lock the account, disable the forwarding rule, find out what else the attacker touched, and get your people working again. Our business continuity guide covers that part and the systems behind it.

Very little of the work in days two through five is a technology problem, and the calls you make in those days decide a lot of what the incident ends up costing.

Call Your Bank and File With the FBI the Day You Find Out

If money left the building, this comes before everything else. The FBI’s guidance on business email compromise is blunt: contact your financial institution immediately, ask for a recall of the funds, and file a complaint at ic3.gov as soon as possible, whatever the amount.¹ The same notice says the IC3 may be able to help banks and law enforcement freeze the funds, and that time is of the essence.

The recall is between you and your bank, because it’s your account and your relationship. We help with the IC3 report, since most of what it asks for is technical: the fraudulent sending domain, the message headers, the login activity, and the dates. Nobody can promise the money comes back.

Call Your Insurance Carrier Before You Hire Anybody

If you have a cyber policy, you make this call, not us. Find the incident hotline in your policy and report what happened.

The carrier will typically assign an attorney and a forensic firm from its approved list, and a PR firm too if your policy covers one. If you pick your own counsel, it won’t be covered. The only counsel your policy pays for is the one the carrier provides.

Two things to check in your policy before you need them. First, read what it says about notice and approved vendors, so you know what has to happen before anyone new starts work. Second, check whether it covers social engineering or funds-transfer fraud and what the limit is. A wire you sent yourself, to an account you were tricked into using, may sit under a different coverage than the investigation does.

What Happens When the Forensic Firm Shows Up

The carrier’s forensic firm works inside your environment, which means inside the environment we manage. Their job is to establish what the attacker accessed and how they got in. Ours is to make that fast.

Before we clean anything up, we export and preserve the evidence: the Microsoft 365 audit log, sign-in history, mailbox rules, and the messages the attacker sent or read. The FTC’s breach guidance says the same thing in plainer terms: don’t destroy any forensic evidence in the course of your investigation and remediation.² Microsoft 365’s unified audit log keeps 180 days of activity by default, and only if it’s turned on. We make sure it’s on for every client when we take over the environment. If nobody has ever checked yours, the record the forensic firm needs may not exist.

Then we give the forensic firm the access it asks for and answer its questions about how your environment is built. We also write up what we saw and when, at your counsel’s direction.

Whether Florida Law Requires You to Notify Anyone

This is breach counsel’s call, not ours, but the question comes up even when “only” an email account was compromised.

Florida’s breach law, the Florida Information Protection Act, counts a username or email address combined with its password or security question and answer as personal information.³ It also covers someone’s name combined with things like a Social Security number, a driver license number, a financial account number with its access code, or medical and health insurance information. Accounting mailboxes are full of W-9s, payroll questions, and bank letters, so counsel will want to know what was sitting in that mailbox and whether the attacker opened it.

When notice is required, the statute requires it as quickly as practicable and no later than 30 days from the point you determine a breach occurred (or have reason to believe one did). Affected Floridians get notified within that window, and so does the Florida Attorney General’s office if 500 or more people in the state are affected.³ That clock can start the same day you find the compromise, which is one more reason days two through five matter.

Counsel decides from facts, and the facts come from the logs. That’s the most useful thing we do in this part: answering “what exactly was accessed, from where, and when” as precisely as the logs allow.

Telling Clients, Vendors, and Your Own Staff

Whoever writes these messages, counsel should see them before they go out. That includes the call to the vendor whose identity was used and the note to clients who may have received a message from your compromised account. The FTC also suggests checking with your law enforcement contact about timing so a notice doesn’t get in the way of the investigation.²

Your own staff need a short version too: what happened, what changed (new sign-in prompts, a new rule for verifying payment changes), and who to tell if a client or vendor calls asking about it.

What We Do During Those Days

For clients, our part of days two through five looks like this:

• Preserve the evidence before anything gets cleaned up: the Microsoft 365 audit and sign-in logs, mailbox rules, and the affected messages.
• Support the carrier’s forensic firm with access, answers about your environment, and anything else it needs to finish its report.
• Rebuild and harden. We reset credentials, remove anything the attacker left behind, and close the path the attacker used.
• Write the timeline of what we saw and when, for your counsel and the forensic firm.

We’re not a forensic firm, and we don’t give legal advice.

Build the Plan Before You Need It

A data breach response plan for a small business doesn’t need to be long. It needs the right phone numbers written down somewhere you can reach when your email isn’t working.

Then fix the process the attacker used. For business email compromise that’s almost always the payment-change process: any change to a vendor’s bank details gets confirmed by phone, at a number you already had on file, before money moves. Our construction and professional services pages go into why those two industries are frequent BEC targets.

Talk to Us About Your Setup

If you want help putting that page together, or want to know whether your Microsoft 365 audit log is even turned on, start a conversation.

Sources

1. Business Email Compromise: The $55 Billion Scam. FBI Internet Crime Complaint Center, Public Service Announcement I-091124-PSA, September 11, 2024. Reports $55.5 billion in domestic and international exposed dollar loss from October 2013 to December 2023, and advises victims to contact their financial institution immediately to request a recall and to file at ic3.gov regardless of the amount lost. ic3.gov
2. Data Breach Response: A Guide for Business. Federal Trade Commission, August 2023. Covers securing operations, assembling forensic and legal help, preserving evidence, and coordinating notification timing with law enforcement. ftc.gov
3. Section 501.171, Florida Statutes: Security of confidential personal information. The Florida Legislature, 2026 Florida Statutes. Defines personal information (including a username or email address with its password or security question and answer), and sets 30-day notice deadlines to affected individuals and, for breaches affecting 500 or more Floridians, to the Department of Legal Affairs. This is a summary, not legal advice; your breach counsel decides what applies. leg.state.fl.us