Weird thing on O365 account
-
Sounds exactly like O365 accounts we've seen hacked in the past.
-
@scottalanmiller said in Weird thing on O365 account:
Maybe her account was hacked. Send her an email and see if it goes straight to deleted.
OK, that would make sense.
-
@coliver said in Weird thing on O365 account:
This was definitely hacked. It may have been a coincidence that they went to Jamaica at the same time.
You'll want to revoke any login tokens and check for any forwarding rules, reset the password, and check for inbox rules. Pitch them MFA.
Thanks!
-
Yep, hacked
-
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
-
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
-
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
-
@IRJ said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
Huh - that's the first time I've ever heard that... Thanks, the ammo is worth while.. I'll let you ya'll know what they say tomorrow.
-
-
@coliver said in Weird thing on O365 account:
This was definitely hacked. It may have been a coincidence that they went to Jamaica at the same time.
You'll want to revoke any login tokens and check for any forwarding rules, reset the password, and check for inbox rules. Pitch them MFA.
What he said.
Been there done that several times. Even had someone reply to an email from the compromised account asking "Is this really you?"........ The response was of course "Yes it is me"........ Whoops there goes another account. 
-
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
-
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
Huh - that's the first time I've ever heard that... Thanks, the ammo is worth while.. I'll let you ya'll know what they say tomorrow.
How do we know that their account has a poor reputation? You can look that up. We've had accounts disabled for poor reputation and never tied to being hacked, always tied to bad employees (yes we fired people.) It's unlikely that they have a bad reputation unless MS told you so.
-
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
-
@Dashrender Anybody notify Accounting of these fraudent emails being forwarded to them?
-
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
I mean his job is a consultant for IT. MFA isnt really even security at this point, it's common sense. Unsurprisingly without MFA, they were hacked again.
-
@DustinB3403 said in Weird thing on O365 account:
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
Sounds like an IT problem to me. They shouldnt need to pay for a security expert to pitch MFA.
-
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
Exactly, as I said, I'm just a consultant. I'm not Outsourced IT like Scott sometimes is.
-
@scottalanmiller said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
Huh - that's the first time I've ever heard that... Thanks, the ammo is worth while.. I'll let you ya'll know what they say tomorrow.
How do we know that their account has a poor reputation? You can look that up. We've had accounts disabled for poor reputation and never tied to being hacked, always tied to bad employees (yes we fired people.) It's unlikely that they have a bad reputation unless MS told you so.
I've never even heard of this bad reputation thing before, so it's good just to know it exists.
-
@Danp said in Weird thing on O365 account:
@Dashrender Anybody notify Accounting of these fraudent emails being forwarded to them?
Actually - the two accounts being forwarded are legit. Only the the send to trash is bad/fake.
-
@DustinB3403 said in Weird thing on O365 account:
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
Scott is not wrong - sure that's a huge part of IT's job, but if those who control the purse strings and tell you what you can and cannot enable, that's beyond IT's control.
This particular client has way less than desirable security habits, they have already made several requests that fly in the face of general security, let alone healthcare based security.
All that said - with this fresh in their minds, I will be broaching the topic specifically about 2FA tonight.
