Weird thing on O365 account
-
One of my clients, their owner just got back from Jamaica. While she was there, she tried to send an email, and that tripped alarms in O365 - but only one alarm was ever tripped, and the alarm said it was a warning, and only after more issues would any corrective action be taken automatically.
She's back now - and now whenever she is sending out emails, the Profile Name of the account was changed to a non existant phone number +1-507-110-8801.
She also believes she hasn't received any email on that account since the day she sent an email while in Jamaica (though the deleted items folder disagrees with her).
Thoughts on this weird profile name change?
-
When I try to send to her in Outlook on the web, it shows the above, even though I've modified the user list back to her real name.
-
She likely has a fubar'd contact in one of her devices.
-
Maybe her account was hacked. Send her an email and see if it goes straight to deleted.
-
@scottalanmiller said in Weird thing on O365 account:
Maybe her account was hacked. Send her an email and see if it goes straight to deleted.
That's probable, but the number showing up in the 'to' field is from the contacts.
-
This was definitely hacked. It may have been a coincidence that they went to Jamaica at the same time.
You'll want to revoke any login tokens and check for any forwarding rules, reset the password, and check for inbox rules. Pitch them MFA.
-
@coliver said in Weird thing on O365 account:
This was definitely hacked. It may have been a coincidence that they went to Jamaica at the same time.
You'll want to revoke any login tokens and check for any forwarding rules, reset the password, and check for inbox rules. Pitch them MFA.
That's what I was thinking.
-
Sounds exactly like O365 accounts we've seen hacked in the past.
-
@scottalanmiller said in Weird thing on O365 account:
Maybe her account was hacked. Send her an email and see if it goes straight to deleted.
OK, that would make sense.
-
@coliver said in Weird thing on O365 account:
This was definitely hacked. It may have been a coincidence that they went to Jamaica at the same time.
You'll want to revoke any login tokens and check for any forwarding rules, reset the password, and check for inbox rules. Pitch them MFA.
Thanks!
-
Yep, hacked
-
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
-
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
-
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
-
@IRJ said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
Huh - that's the first time I've ever heard that... Thanks, the ammo is worth while.. I'll let you ya'll know what they say tomorrow.
-
Just in case you need this
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide
-
@coliver said in Weird thing on O365 account:
This was definitely hacked. It may have been a coincidence that they went to Jamaica at the same time.
You'll want to revoke any login tokens and check for any forwarding rules, reset the password, and check for inbox rules. Pitch them MFA.
What he said.
Been there done that several times. Even had someone reply to an email from the compromised account asking "Is this really you?"........ The response was of course "Yes it is me"........ Whoops there goes another account. 
-
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
-
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
Huh - that's the first time I've ever heard that... Thanks, the ammo is worth while.. I'll let you ya'll know what they say tomorrow.
How do we know that their account has a poor reputation? You can look that up. We've had accounts disabled for poor reputation and never tied to being hacked, always tied to bad employees (yes we fired people.) It's unlikely that they have a bad reputation unless MS told you so.
-
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
-
@Dashrender Anybody notify Accounting of these fraudent emails being forwarded to them?
-
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
I mean his job is a consultant for IT. MFA isnt really even security at this point, it's common sense. Unsurprisingly without MFA, they were hacked again.
-
@DustinB3403 said in Weird thing on O365 account:
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
Sounds like an IT problem to me. They shouldnt need to pay for a security expert to pitch MFA.
-
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
Exactly, as I said, I'm just a consultant. I'm not Outsourced IT like Scott sometimes is.
-
@scottalanmiller said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@Dashrender said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
@coliver said in Weird thing on O365 account:
Pitch them MFA.
Nah. Just set it up, and say its security in place so you wont get hacked again.
No pitch needed, just do it.
I don't have that level of authority, I'm an IT consultant for them, nothing more.
I have a meeting with them tonight (the whole company actually - some training stuff), but in light of this SECOND hack - I'm seriously thinking I ditch all of my current conversation and talk about password managers and 2FA only.
Second hack? Then you didn't do your job the first time.
There is really no discussion. Its a must have and they could lose their Office 365 account otherwise. Their account already has a poor reputation with Microsoft.
It's not a conversation, it's you do this or a drop you as a client
Huh - that's the first time I've ever heard that... Thanks, the ammo is worth while.. I'll let you ya'll know what they say tomorrow.
How do we know that their account has a poor reputation? You can look that up. We've had accounts disabled for poor reputation and never tied to being hacked, always tied to bad employees (yes we fired people.) It's unlikely that they have a bad reputation unless MS told you so.
I've never even heard of this bad reputation thing before, so it's good just to know it exists.
-
@Danp said in Weird thing on O365 account:
@Dashrender Anybody notify Accounting of these fraudent emails being forwarded to them?
Actually - the two accounts being forwarded are legit. Only the the send to trash is bad/fake.
-
@DustinB3403 said in Weird thing on O365 account:
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
Scott is not wrong - sure that's a huge part of IT's job, but if those who control the purse strings and tell you what you can and cannot enable, that's beyond IT's control.
This particular client has way less than desirable security habits, they have already made several requests that fly in the face of general security, let alone healthcare based security.
All that said - with this fresh in their minds, I will be broaching the topic specifically about 2FA tonight.
-
@IRJ said in Weird thing on O365 account:
@DustinB3403 said in Weird thing on O365 account:
@scottalanmiller said in Weird thing on O365 account:
@IRJ said in Weird thing on O365 account:
Second hack? Then you didn't do your job the first time.
Security is THEIR job, not his. They are the CIO, not him. You can't blame people down the chain for the decision makers making bad decisions.
What world are you living in? This is how 99.99999% of IT lives, getting blamed for other peoples bad decision making.
Sounds like an IT problem to me. They shouldnt need to pay for a security expert to pitch MFA.
That's not the issue. The issue is someone in charge of IT that doesn't listen / care.
-
@Dashrender said in Weird thing on O365 account:
Scott is not wrong - sure that's a huge part of IT's job, but if those who control the purse strings and tell you what you can and cannot enable, that's beyond IT's control.
And at the end of the day, the best sales person in the world can't 100% of the time convince an owner what to do.
-
Nor is it their job. The decision maker is the final IT head, and if IT says not to do something, random "lower" IT people are not responsible.
