All tabletop exercises
Email / BEC·Advanced·Mixed audience
Your own mailbox is used to defraud customers
The prompt — read this to the room
Three customers call within a day to say they paid your invoices to new bank details your accounts receivable team emailed them. The emails came from your real billing mailbox, sat inside genuine threads and used your invoice template. Logs show the mailbox has been accessed from overseas for 26 days through a legacy mail protocol that skips MFA. Losses so far total $430,000 across three customers, and the mailbox holds 2,100 customer contacts. Customers want to know who is liable. Your general counsel asks: must we warn all 2,100 today?
Total duration
2 h 15 min
People to involve
8
Best fit
Manufacturing, Saas
Who to involve
Most important first.
- CISO / Head of security
- Incident response lead
- SOC analyst
- Legal counsel
- CFO / Finance
- Communications / PR
- Customer support
- Privacy officer / DPO
What it tests
- Scope 26 days of mailbox access: what was read, which threads were hijacked and which customers were targeted.
- Decide on a customer warning that protects customers without making avoidable admissions.
- Handle liability discussions with affected customers and insurers.
- Close legacy authentication across the tenant and confirm nothing similar remains.
Outline of activities
- 1Three customer calls
- 2Scoping 26 days of access
- 3Containing the tenant, not just the mailbox
- 4Warning 2,100 customers
- 5Liability, insurers and law enforcement
- 6Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…