Cyber security
Someone clicked a phishing link at work: what to do, in order
A click on its own may have done nothing. A password typed into the page that opened is a different matter, and the order you work in decides whether the attacker keeps a way back in.
By Oscar CobbeCurrent as at 3 minute read4 sources
First: what was given away
Ask the person exactly what happened after the click, and write it down with the time. There are three cases, and they need different responses.
- 1The link opened a page and nothing was typed. The NCSC's advice is to run a full scan with your antivirus software and to report the email.
- 2A password was typed into the page. Treat the account as taken: the steps below, now.
- 3Bank or card details were given. The NCSC's advice is to contact your bank for advice on what to do next, and to report a fraud to An Garda Síochána at your local Garda station.
If a password was typed in
Microsoft's guidance for a Microsoft 365 account that may be compromised is to block access first and investigate second. Its order:
- 1Disable the account while you investigate. Where you cannot, reset the password, and do not send the new one to the user by email: the attacker may be reading that mailbox.
- 2Revoke the account's active sessions, so an attacker who is already signed in is thrown out as well as locked out of the next sign-in.
- 3Check the account's two-step sign-in methods and remove any phone or app you do not recognise. An attacker who adds their own method can come back after a password change.
- 4Check the apps the user has given access to, and the admin roles the account holds, and remove anything that should not be there.
- 5Check for forwarding and inbox rules. Microsoft lists rules that forward mail to unknown addresses, or move it to Junk, Notes or RSS folders, as signs of compromise.
App passwords survive a reset
Microsoft says app passwords are not revoked when the account's password is reset. Older mail apps that use them keep working until the user deletes them and creates new ones.
Then: what the attacker did
Microsoft's list of symptoms is the checklist: messages in Sent Items or Deleted Items the user did not write, new forwarding to an outside address, changed contact details in the address book, unexplained lockouts, and a mailbox blocked from sending because it sent too much.
Look at the sign-in logs from the time of the click onwards, for sign-ins from places and times the user cannot explain, and at what was sent. If invoices went out, ring the customers who received them, on a number you already hold, before they pay one. What stops invoice redirection covers why the number in the email cannot be trusted.
Is it a data breach?
If the account held personal data (customers' emails, staff records, anything with names in it) and someone else got into it, that is a personal data breach under the GDPR, whatever they did once inside.
The European Data Protection Board says you become aware of a breach when you have a reasonable degree of certainty that one has happened, and from then you have 72 hours to report it to the Data Protection Commission, unless it is unlikely to put people at risk. Write down the time. The GDPR deadline calculator turns it into the exact deadline, and the first 72 hours gives the order of work, including when the people affected must be told.
Afterwards: close the way in
In the same guidance Microsoft highly recommends enabling and enforcing two-step sign-in, and calls it essential for any account with admin rights. A password typed into a fake page is worth far less to an attacker when it is not enough on its own. Two-step sign-in on Microsoft 365 and Google Workspace covers the difference between allowing it and requiring it.
Then tell the rest of the staff what the email looked like. The NCSC's quick guide lists the signs to look for: a greeting that does not use your name, a sender address that does not match the name, urgency, and a request to reset a password you did not ask to reset.
Sources
- 1.Quick Guide: Phishing · National Cyber Security Centre
- 2.Respond to a compromised email account in Microsoft 365 · Microsoft Learn
- 3.Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 · European Data Protection Board
- 4.Regulation (EU) 2016/679 (GDPR), Articles 33 and 34 · EUR-Lex, Publications Office of the European Union
Free, and no account needed
Work out the breach deadline
Enter when you became aware, in Irish time, and see the exact time a report to the Data Protection Commission is due.
Run the free checkA plan, practised before you need it
Protect includes a written incident plan practised with you, two-step sign-in required on every account, and a tested backup restore, alongside SPF and DMARC, a privacy notice and cookie consent. From €2,950 up to 10 staff, fixed before we start.
ProtectWho wrote this
Oscar Cobbe · Founder, FourWinds Digital
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.
More about how we work →Read next
- GDPRYou have had a data breach. What the first 72 hours require
- Payment fraudA supplier emails new bank details. What should happen next
- Cyber securityTwo-step sign-in on every mailbox: turning it on, and proving it
Written on 29 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.