A supplier's e-mail account was hacked and they wrote to us. What should we do?

Assume that every recent message from that supplier could be fake until confirmed. Put payments to them on hold briefly and confirm the bank details by phone, on a number you already have. Warn finance and anyone who deals with the supplier, and ask IT to search your mailboxes for messages from that address in the period concerned, especially those with links, attachments or payment instructions, and to remove or quarantine them. If anyone clicked a link or entered a password, follow your phishing response steps. Ask the supplier when the compromise began and what they know, and keep a short record: supply-chain security is one of the risk-management measures NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. expects covered companies to handle. Check whether any of your staff replied with sensitive data. On the network side, look at whether the devices of people who opened those messages show new outbound connections or unusual activity.

← All 29 questions on Phishing and e-mail aftermathAll topics