BEC · Incident Response · Incident Response
O365 takeover · supplier invoices stolen for 11 months via an auto-forward rule
An accounting assistant's O365 mailbox was compromised 11 months ago. The attacker used an 'Inbox rule' to forward all supplier invoices to themselves · changed IBANs and sent fake invoices. Monthly loss 240K TL. A supplier is calling asking 'where is our money.' You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown