What to Do After a Phishing Attack
Someone at your company clicked a phishing link. Credentials have been compromised. And attackers may already have access to your systems.
Phishing attacks aren't just about stolen passwords anymore. Modern phishing campaigns are sophisticated operations that target your business systems, financial accounts, and client data. Even if you change passwords immediately, attackers often establish persistent access that survives password resets. This guide explains what's really happening and what you need to do right now.
Available 24/7 for incident response
What Happened to Your Business
Understanding the type of phishing attack helps determine the scope of exposure and the urgency of response. Modern phishing campaigns target specific vulnerabilities in your business systems.
Credential Harvesting
Fake login pages mimicking Office 365, Google Workspace, or VPN portals. Employee enters credentials, attacker gains direct access.
Exposure: Immediate system access, email control, cloud storage
Business Email Compromise (BEC)
Attackers impersonate executives or trusted vendors to authorize wire transfers, payroll changes, or invoice payments.
Exposure: Financial fraud, vendor payment interception
Invoice & Payment Fraud
Fake invoices or payment requests from compromised vendor accounts. Often discovered only after payment is sent.
Exposure: Direct financial loss, banking information compromise
Spear Phishing
Highly targeted attacks using personalized information. Often the precursor to more sophisticated intrusions.
Exposure: Strategic access to specific systems or data
The Scope of Exposure
Once an attacker has valid credentials, they can access everything that employee could access. This typically includes:
- All email including sent items, archived messages, and attachments
- Cloud storage such as OneDrive, SharePoint, Google Drive
- Contact lists for targeting additional phishing attacks
- Financial systems including accounting software and banking portals
- Customer data and proprietary business information
- VPN and remote access to internal network resources
Why Speed Matters: What Attackers Do Within Minutes
Once attackers gain access, they work quickly to establish persistence before you discover the breach. Every minute counts:
- Within 5 minutes: Set up email forwarding rules to monitor all communications
- Within 15 minutes: Register new devices as "trusted" to bypass MFA requirements
- Within 30 minutes: Download sensitive documents and exfiltrate email archives
- Within 1 hour: Create alternate access methods (OAuth apps, mailbox delegates, backup accounts)
- Within 24 hours: Initiate wire transfer fraud or invoice payment schemes
Password changes alone DO NOT remove these persistence mechanisms. Professional response is required.
Why Professional Response Is Critical
Most businesses make the mistake of thinking that changing passwords is enough. It's not. Modern phishing attacks establish multiple layers of persistent access specifically designed to survive password resets.
Hidden Persistence: Why Password Changes Aren't Enough
Attackers know you'll change passwords. That's why they immediately establish alternative access methods that continue working even after credentials are reset. Here's what remains after you change passwords:
- Email forwarding rules: All emails continue forwarding to attacker-controlled addresses. You won't see this in your inbox rules.
- Trusted devices: Devices registered during the attack maintain access without requiring new authentication.
- Active session tokens: Browser sessions remain valid for hours or days after password changes.
- OAuth applications: Third-party apps granted during the attack retain full access to email and files.
- Mailbox delegates: Additional users granted access to read and send email on your behalf.
- Malware installation: Keyloggers or remote access tools deployed to capture new passwords.
This is why businesses that "just changed passwords" discover weeks later that attackers still have access.
Legal and Compliance Implications
How you respond to a phishing attack isn't just about security—it's about legal liability and regulatory compliance:
HIPAA (Healthcare)
Compromised healthcare credentials constitute a breach requiring investigation, documentation, and potentially patient notification. HHS expects professional incident response.
GDPR / CCPA (Data Privacy)
If customer or employee data was accessed, privacy regulations require documented assessment of exposure and timely notification.
Financial Services Regulations
Banks, investment firms, and accounting practices face strict incident reporting requirements to state and federal regulators.
Cyber Insurance Claims
Insurance carriers require professional forensics and documentation for claims. DIY response may void coverage.
Customer Contracts
Many client agreements require specific security incident procedures and notification timelines.
Professional Liability
Legal, accounting, and consulting firms have heightened duty of care for client confidential information.
Immediate Action Checklist
Time is critical. Every hour that passes gives attackers more opportunity to establish persistence and exfiltrate data.
Follow this timeline to minimize damage and begin proper recovery.
First 2 Hours: CRITICAL WINDOW
This is your window to prevent attackers from establishing persistent access. Do not delay these steps.
First 24 Hours: Investigation Phase
First Week: Professional Response & Remediation
Ongoing First Month: Long-Term Protection
What You're Probably Feeling
A phishing attack affects you personally, not just technically. Most business owners and managers go through these emotional stages:
Disbelief and Denial
"This can't be real. Maybe it's a false alarm. The email looked legitimate. How could someone fall for this?" The initial shock that this actually happened to your business.
Anger (But Don't Blame the Employee)
"How could they click on that? Why weren't they paying attention?" It's natural to feel frustrated, but remember: these attacks are designed by professionals to deceive even security-aware people.
The employee who clicked didn't want this to happen. They feel terrible. Blaming them makes them afraid to report future security concerns, which makes your business less secure. Modern phishing is sophisticated enough to fool anyone.
Bargaining and Minimizing
"Maybe they didn't actually access anything. Maybe just changing the password is enough. Do we really need to spend money on forensics?" The hope that this isn't as serious as it seems and you can handle it internally.
The Weight of It All
"What if they stole client data? What if there's a wire transfer I don't know about yet? What are my notification obligations? Am I personally liable?" The overwhelming realization of potential consequences and legal exposure.
Moving Forward
"I need to understand exactly what happened. I need professional documentation. I need to know this is properly fixed and won't happen again. I need to protect my business and my clients."
This is the right mindset. You're not overreacting. Phishing attacks on businesses are serious incidents that require professional response. Getting expert help isn't admitting failure—it's making the responsible decision to protect your business, your employees, and your customers.
Get Expert Help Now
Mainstream Technology provides immediate phishing incident response for mid-sized businesses. We've handled hundreds of credential compromise incidents across healthcare, legal, financial services, and other regulated industries.
What Mainstream Provides for Phishing Response
- Immediate containment to stop active attacker access and data exfiltration
- Complete audit of all persistence mechanisms (forwarding rules, delegates, OAuth apps, session tokens)
- Forensic analysis to determine what data was accessed and exfiltrated
- Breach notification assessment for HIPAA, state privacy laws, and contractual obligations
- Insurance documentation with detailed timeline and evidence for claims
- MFA deployment across all business systems if not already implemented
- Advanced email security to prevent future attacks
- Security awareness training for all employees
- Ongoing monitoring to detect any continued attacker activity
- Clear communication in plain language—no confusing technical jargon
Time Is Critical: Attackers Are Working Right Now
While you read this, attackers may be actively monitoring your emails, setting up additional access methods, or preparing wire transfer fraud. Every hour of delay increases your exposure, your legal liability, and your remediation costs. Don't wait until you discover financial fraud or a regulatory violation. Contact us now for immediate assessment and response.
Talk to Craig Directly
Craig Chadwick, Vice President of Mainstream Technology, personally handles phishing incident response consultations. No sales pitch. No runaround. Just direct, honest answers about what happened and what needs to happen next.
Craig Can Help You Understand:
- How bad this really is and what data may have been compromised
- What needs to happen right now vs. what can wait
- Whether you need outside help or if your current IT provider can handle this
- If your current remediation plan is actually sufficient
- What your cyber insurance will cover and what documentation they need
- Your breach notification requirements for HIPAA, state laws, or customer contracts
Craig will tell you honestly whether this is something you can handle internally or if you need professional incident response—even if that means working with someone else. No pressure. Just honest guidance you can trust.
"We only recommend what you actually need—nothing more, nothing less."
Talk to Craig—No Sales Pressure, Just Honest Advice
Complete this form and we'll contact you within 2 hours for active incidents, or within 24 hours for post-incident assessments. Available 24/7 for emergency phishing response.
(•••) •••-••••
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.