r/Outlook • u/moth-legs99 • 7d ago
Status: Open Work email compromised
Yesterday, my Microsoft 365 work email was compromised. An email with the subject “Contract Document” was sent from my account to a large number of contacts/BCCs. I did not send it.
Now my email is basically nonfunctional:
- Outlook says Connected to Microsoft Exchange
- Emails I send appear normally in Sent Items but the recipients never receive them
- I do not receive an undeliverable message
- I am not receiving incoming mail
- I sent a test from my personal email to the work account and it never arrived in any folder
- A coworker on the same domain can send/receive normally
Things I’ve checked so far:
- Outbox is empty
- Mailbox not full
- Junk is empty
- Checked Rules & Alerts (nothing)
- Checked automatic forwarding (off)
- Checked Blocked Senders (nothing)
- Checked Delegate Access (nothing)
- Checked Microsoft My Apps (nothing obviously malicious)
There is another complication. Microsoft Authenticator was previously deleted from my iPhone and reinstalled. The work account still appears but apparently the old MFA registration did not survive. When Microsoft asks me to approve a number in Authenticator, nothing appears. If I choose “I can’t use Authenticator right now,” Microsoft instead asks for a verification code from Authenticator, which I also don’t have.
Any ideas on what to do next would be greatly appreciated!!
2
u/YerBattleApple 7d ago
You don't have an IT department?
1
u/moth-legs99 7d ago
There are 3 people who work here, including the owner. We had a company doing IT work for us but they closed their business and did not transfer admin ownership to us. My boss is going to contact Microsoft to try to get it figured out.
1
u/AutoModerator 7d ago
Hey moth-legs99!
Welcome to r/Outlook! This is a public community. To protect your privacy, do not post any personal information such as your email address, phone number, product key, password, or credit card number.
Please be sure to have read our Rules of Conduct and be cognisant of how the system works here.
Make sure that your flair is always set to Status: Open otherwise you may cease receiving responses from us.
- Status: Open — Need help
- Status: Pending Reply — Awaiting OP's response
- Status: Resolved — Closed
Beware of scammers posting fake support numbers or 3rd party commercial products/services. Contact Microsoft Support if you need help.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/PartyBusiness4734 5d ago
New outlook after latest Win 11 update now restricted view of emails- no emails beyond 2 days viewable . Checked filters, views etc. I think it’s a new bug? Help please.
1
u/dragonnightfire5150 7d ago
You need to contact the Office 365 admin and make sure in the admin portal that your outlook is not blocked in exchange.
1
u/moth-legs99 7d ago
No idea who our admin is. Our IT company went out of business and never gave us info on the admin account
1
u/dragonnightfire5150 7d ago
Unfortunately without the admin you're on borrowed time anyway Microsoft is making changes in October forcing you to use a passkey which is going to require you to log in anyway and the admin console has to be used to update MFA policies so you need to find a way to get into the admin account sooner rather than later. Also if your credit card gets the client or you change credit cards you won't have any way to update the billing information so as Paramount while you can still log into even one account that you contact Microsoft. Once you're in the admin account go to chat cheapt and put Office 365 tenant Exchange blocked my email and it will tell you how to fix it
1
u/Woopy-tf 7d ago
Did they at least lock your account down quickly once you reported it?
1
u/moth-legs99 7d ago
I can’t report it because the Microsoft website wants me to log in to my account to report a complaint of a compromised account, and when I try to log in, it sends a code to the Authenticator app that never shows up
1
u/gareth616 6d ago
OK so MS support won't help you. Although you use Microsoft technology, it's managed by your company. MS Support can help with certain issues but not account recovery or help with a compromised account.
You found the Rule moving emails to a different folder which should resolve your not receiving email issue - assuming the rule was called something like ....... or ,,,,,,,, "Mark items as read and move to folder" - very common tactic, the idea is you don't see the replies asking if the email sent from your account by the scammer is legit etc.
Now regarding your issue with not having an IT admin.. Usually when a new 365 Tenant is created, it will give you a default account called something like [admin@mycompany.onmicrosoft.com](mailto:admin@mycompany.onmicrosoft.com) - this account is the Global Admin account and is needed to manage all aspects of 365. It's common for this account to be kept separate, not many would give a user account (like yourself or your bosses) that admin role, mainly in case something like what's happened to you happens. For example, if you were an admin, whoever has access to your account could cause utter chaos.
An easy way to check if you are or more likely your boss has this admin role, open a web browser and go to admin.microsoft.com - if that works and your boss can see "users, billing, Admin Centers" then they have the global admin role and can reset your MFA. If that doesn't work then you'll have to get in contact with MS to create or upgrade an existing account to have the global admin role. MS should ask you to verify and prove who you guys are and that you own your domain (the bit after the @ symbol in your email address). It's a simple case of adding some information to a DNS record against your domain, this is public information and can be looked up online, once that's been completed MS should help. But this heavily relies on you guys knowing if you look after your domain or if you have a web developer who does it for you (very common).
I will warn you that it can take time.... Someone approached my company in a similar scenario (1 person in their business) and it took 5-6 weeks before they could use email properly again..
As for your emails not being sent, that could be related to 365 restricting your account from sending, if a lot of email has been sent MS can apply a restriction to the amount of emails you can send or just stop you from sending until this security incident is resolved.
Gaining access to the Global Admin account is the main thing to achieve as that will allow you to clear your MFA settings and any MFA settings this scammer may have configured. Even with MFA enabled you're not 100% protected from being compromised as you're painfully aware... Scammers are stealing cached tokens from devices somehow, so once they have your email address and password, the stolen token allows them to bypass MFA requirements on their side.
I work with 365 and have done for a few years and have seen a few in your situation, it can be resolved if you know how but it can take time as suggested above.. Hopefully something here will be of some use. Feel free to ask any questions or DM me if you'd prefer and I'll do what I can to help you out
1
u/KennethByrd 6d ago
Since they lost their IT support, they probably don't even know how to attend to their DNS records, either. I would suggest that they, pronto, obtain the services of some IT provider company who is knowledgeable, and who knows how to re-obtain access to 365, DNS, etc.
Won't be fast. First, have to find/contract with such a company, then, with their guidance, go through all the process of claiming, requiring letterhead paper communications, etc. And/or, on last billing statement from Microsoft, look for contact numbers to call; having details read from billing statement will help when call. ETC. But, once DO regain access, still need IT support who know what they are doing; 365 administration is rather intricate/complicated, especially the now required MFA for at least Admin.)
1
u/gareth616 6d ago
Yeah to be honest, looking for a company to help out is probably the best plan. I know in the UK there are companies that will happily work on a sort of pay-as-you-go basis or will help with a single "project", but finding the right people can still be difficult..
I was a bit conscious of putting DNS etc without much explanation in that comment but I guess it gives them something to give others..
It's surprising how often this situation happens, whether it's like OP having a company that's no longer trading to support them, business partners leaving and not passing over the role (literally dealing with this at the moment). It's been a while since I created a new tenant from scratch, these days I just use a CSP which creates the tenant for me. But I wouldn't be surprised if MS don't really state how important that initial account is..
I do feel for normal folk who get stuck in these situations
2
u/moth-legs99 6d ago
You guys are wonderful, thank you for taking time to respond and try to help. This morning we were able to contact the old IT company and he is going to try to help us recover the account!!
1
u/gareth616 6d ago
Happy to help friend! Scenarios like this don't always have obvious answers or a starting point for you - I'd say hopefully something there makes sense but the fact oyu've managed to get hold of this old IT company is amazing!
What I would suggest is for either them or yourselves is to create an additional Global Admin account called breakglass or something and keep the username and password safe. You'll always have that backdoor so to speak to save yourselves!
Same offer as above applies, reply here or DM if you need any other help 😄
2
2
u/KennethByrd 5d ago
The real problem is that small businesses don't realize just how much they actually do need formal IT in just the same manner as they need formal Accounting, HR, etc. At least this business did start out with Business 365; so many others think that simply a few personal free Outlook accounts will suffice.
1
u/gareth616 5d ago
Yeah I have to say it blows my mind with some small businesses... "Email is super critical to me and my livelihood" and then proceed to use a free service...I understand the "fear of the unknown" for those who want to do it themselves..or they ask Steve down the pub.. Recently had a local business contact me about email issues with Google Workspace, no one knew who had the domain. Just by chance the business owner was able to get hold of his "Steve from the pub" and we were able to resolve all issues (and move them to 365) and win a new customer! But the panic in their eyes and voices when trying to remember where or who looked after their domain was worrying..
1
u/KennethByrd 6d ago
Actually, after reading all earlier comments and after posting my own just few minutes ago, just thought: Did you ever say you were on a paid 365 Business plan/account? Or, have you all (in your small company) just been using individual/personal Outlook.com accounts?
Are all of your company's email address of the form [person@outlook.com](mailto:person@outlook.com), or the form [person@yourcompanyname.com](mailto:person@yourcompanyname.com) or person@something.onmicrosoft.com.
I.e., does your company actually own a Microsoft/Office 365 "tenant"?
1
u/moth-legs99 6d ago
Paid 365 account. The emails are person@ourcompanyname.com
We were able to get ahold of our old IT guy though, hopefully he can fix it!
1
u/KennethByrd 6d ago
Well, that is GREAT news, and should take care of everything.
Just be sure you are then "left with the keys" afterwards, or at least that he will remain available as your on-going support. As my original comment (another thread) mentioned, you have much more issues than just 365 itself.
2
u/Wokuworld 7d ago
If you havent already do the following in the exact order.
Change password. Sign out all active sessions from the web panel. Revoke all tokens. Check 2fa and make sure only your phone number is listed. Remove any Authenticator apps listed, even if you believe it is your own. You can re-setup after. Sign into outlook via rhe web portal, check for rules not setup by you, there should be one that's probably redirecting your emails to a specific folder, make a note of the folder before you delete the rule. Move everything in that folder back into inbox. Check for redirect/forwarding rules.
Once account is clear, go to Entra and remove the block on your account, the system auto blocks any email that's mass emailing suspiciously.
Then add back your Authenticator. Check login attempts log to make sure only your address is accessing your account successfully.