# What do we do if a cloud or SaaS account is compromised?

Contain first, then find out what happened, and keep a record as you go. Containment: reset the password and revoke all active sessions and tokens for the account; remove MFA methods you did not register and re-enrol; check for and delete new forwarding rules, app consents, API keys, users or admin roles the attacker created; and if it was an admin account, look across the whole tenant or cloud account, because attackers create backdoors. Investigation: use the provider's sign-in and audit logs to establish when access started, from where, and what was read, changed, shared or downloaded; check whether the same password was used elsewhere. Then decide on obligations: personal data accessed may mean a GDPR notification within 72 hours of becoming aware, and a significant incident may be reportable under NIS2 in your country. Look at the devices too: the stolen password often came from an infected laptop or a phishing page. On every plan, NetSenX can show whether a device in your network began beaconing, scanning or sending unusual volumes around that time. It does not see the cloud account's sign-ins.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/what-to-do-if-a-cloud-account-is-compromised

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [What is the shared responsibility model in the cloud?](https://netsenx.com/en/faq/what-is-the-shared-responsibility-model-in-the-cloud)
- [What is the difference between IaaS, PaaS and SaaS?](https://netsenx.com/en/faq/what-is-the-difference-between-iaas-paas-and-saas)
- [Does moving to the cloud make us safer?](https://netsenx.com/en/faq/does-moving-to-the-cloud-make-us-safer)
- [What does a network sensor see of our cloud and SaaS traffic?](https://netsenx.com/en/faq/what-does-a-network-sensor-see-of-cloud-traffic)
- [Can NetSenX monitor our servers in the cloud?](https://netsenx.com/en/faq/can-netsenx-monitor-our-cloud-servers)