The following is a composite account based on real incidents we have responded to. Identifying details have been changed.
A partner at a mid-size law firm noticed on a Monday morning that a client had called over the weekend asking about an email she never sent. The email had come from her account — correct address, correct signature, correct everything — asking the client to update their wiring instructions for an upcoming settlement disbursement.
She called us at 8am. By 8:45 we had access to her Microsoft 365 tenant.
What We Found
By 10am we had established that her account had been compromised seventeen days earlier. A phishing email, convincing enough that she had entered her credentials without realizing it. The attacker had authenticated from an overseas IP address within four minutes of credential capture.
For the following seventeen days, the attacker had been a silent observer. They read email. They learned the names of the firm's clients, the structure of ongoing matters, the names of banks and title companies the firm regularly worked with. They identified three active matters with significant wire transfers approaching. Then they created an inbox rule that would intercept any replies to emails sent from her account and delete them before she saw them. Then they began impersonating her.
The client who called over the weekend was the third one they had contacted. The first two had fortunately called the firm directly to confirm before sending anything.
Monday: Containment
By noon on Monday we had revoked all active sessions, removed the inbox rule, identified two other accounts in the tenant that showed signs of reconnaissance activity from the same IP infrastructure, and begun credential resets for all affected accounts.
Wednesday: Full Forensic Picture
By Wednesday we had completed the full forensic investigation. We knew every email the attacker had read, every file they had accessed in SharePoint, every external communication they had sent. The firm had a complete incident timeline — the kind of documentation a cyber insurance carrier requires and a bar association notification demands.
Friday: Hardening and Reporting
By Friday we had implemented the hardening controls that would have made this attack significantly harder — MFA with Conditional Access, legacy authentication blocked, inbox rule alerting configured, mailbox audit logging extended. We delivered the written incident report the firm needed for their cyber insurance carrier and for the bar association notification that was required under state rules.
The Outcome
The outcome was good relative to what it could have been. No wire transfer was completed. No client data was exfiltrated in a way that created notification obligations beyond the bar association. The firm's clients were informed professionally with a clear explanation of what happened and what had been done.
What made the difference was that the firm called immediately, before taking any independent action that might have destroyed forensic evidence. And the controls we put in place afterward mean that if an attacker tries the same approach again, they will be detected within hours instead of weeks.