Incident help

Account takeover

Compromised email or account: regain control and check the impact

DC9 Cyber helps when someone has taken over a company mailbox, a Microsoft 365 or Google Workspace account, or impersonated a supplier (BEC fraud). We establish what the attacker did and remove their access. We contact you within 60 minutes of receiving your report.

Contact channels

First contact
within 60 minutes of receiving your report
Report an incident

First steps

  1. Change the password from a safe device and sign out all sessions.
  2. Check forwarding rules and remove unknown ones.
  3. If money was sent to a changed account, contact your bank immediately.
  4. Warn suppliers through a channel other than email, e.g. by phone.

Signs

  • messages you did not send are leaving your mailbox
  • a supplier received an invoice with changed bank details
  • unknown forwarding rules appeared in the mailbox
  • sign-ins from unusual countries or devices

Report

Report an incident

A few details are enough for us to get in touch — within 60 minutes of receiving your report.

What you noticed and when, which systems or data may be affected, what has been done so far.

Don’t enter passwords, access keys or login details. Don’t send logs or files — we will agree a separate channel for exchanging material.

We will use the data from your report to contact you about the incident. Privacy policy

or write directly: hello@dc9.io

How we help

  • we analyse sign-in logs and the attacker’s actions in the mailbox and cloud
  • we remove their access: sessions, consented apps, rules, devices
  • we establish which messages and data they could read or send
  • we harden the configuration: MFA, access policies, anti-spoofing

Frequently asked questions

Is changing the password enough?

Usually not. The attacker may have active sessions, a registered device or an app with mailbox access. Each of these paths has to be checked and removed.

What if money has already been sent?

Report it to your bank, the recipient’s bank and the police as soon as possible. A fast reaction improves the chance of freezing the funds.

Common situations