# A supplier's e-mail account was hacked and they wrote to us. What should we do?

Assume that every recent message from that supplier could be fake until confirmed. Put payments to them on hold briefly and confirm the bank details by phone, on a number you already have. Warn finance and anyone who deals with the supplier, and ask IT to search your mailboxes for messages from that address in the period concerned, especially those with links, attachments or payment instructions, and to remove or quarantine them. If anyone clicked a link or entered a password, follow your phishing response steps. Ask the supplier when the compromise began and what they know, and keep a short record: supply-chain security is one of the risk-management measures NIS2 expects covered companies to handle. Check whether any of your staff replied with sensitive data. On the network side, look at whether the devices of people who opened those messages show new outbound connections or unusual activity.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/supplier-email-was-hacked-what-should-we-do

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Why can't a network security tool stop invoice fraud?](https://netsenx.com/en/faq/why-cant-a-network-tool-stop-invoice-fraud)
- [Someone is sending fake invoices in our company's name. What can we do?](https://netsenx.com/en/faq/someone-sends-fake-invoices-in-our-name)
- [How do we stop criminals sending e-mail that pretends to come from our domain?](https://netsenx.com/en/faq/how-to-stop-someone-spoofing-our-email-domain)
- [What is DMARC?](https://netsenx.com/en/faq/what-is-dmarc)
- [What is MFA fatigue?](https://netsenx.com/en/faq/what-is-mfa-fatigue)