Services / Identity & Security
Incident response: when the email environment is compromised
A mailbox suddenly sends phishing, customers receive forged payment requests, an unknown file sits on the Exchange server, or the mail gateway vendor reports an exploited vulnerability. In such situations we support containment, analysis and remediation, with a focus on the mail and identity layer.
- Incident Response
- Business Email Compromise
- Microsoft 365
- Exchange Server
- Mail Gateways
- Reporting Obligations
Typical cases
What happens in an incident
- 1 Contain Revoke sessions and tokens, reset passwords and MFA, remove malicious rules and forwarding, isolate affected systems without destroying evidence.
- 2 Preserve evidence Secure the Unified Audit Log, sign-in logs, Message Trace, server and gateway logs before retention periods delete them.
- 3 Analyze Reconstruct the entry point, time frame, affected accounts and messages that were read, sent or exfiltrated.
- 4 Remediate and harden Close the root cause, clean up the configuration, extend monitoring; final report for management, insurer and authorities.
Reporting obligations in Switzerland
If an incident affects personal data and is likely to result in a high risk for the data subjects, the Swiss Federal Act on Data Protection requires notification to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible (Art. 24 FADP). Since 1 April 2025, operators of critical infrastructure must report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours. We provide the technical basis for these reports; the legal assessment remains with you or your legal counsel.
From comparable projects
Further reading
Planning something similar?
In a first conversation, we'll look at where you stand, the risks and the most sensible next step.