What do we do if a cloud or SaaS account is compromised?

Contain first, then find out what happened, and keep a record as you go. Containment: reset the password and revoke all active sessions and tokens for the account; remove MFA methods you did not register and re-enrol; check for and delete new forwarding rules, app consents, API keys, users or admin roles the attacker created; and if it was an admin account, look across the whole tenant or cloud account, because attackers create backdoors. Investigation: use the provider's sign-in and audit logs to establish when access started, from where, and what was read, changed, shared or downloaded; check whether the same password was used elsewhere. Then decide on obligations: personal data accessed may mean a GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). notification within 72 hours of becoming aware, and a significant incident may be reportable under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. in your country. Look at the devices too: the stolen password often came from an infected laptop or a phishing page. On every plan, NetSenX can show whether a device in your network began beaconing, scanning or sending unusual volumes around that time. It does not see the cloud account's sign-ins.

← All 25 questions on Cloud and SaaS securityAll topics