An employee phish: what to do in the first hour

Phishing enters a company through an ordinary mail: an "invoice", a "delivery", "security asks you to confirm the mailbox". In the first hour the damage can still be limited. A day later the mailbox has sent the same link to colleagues, and forwarding rules nobody created are sitting in the mail settings.

The order if the password was already entered

• Change that mailbox password and drop other sessions. Not from the phone that just opened the link, if there is doubt.
• Look at forwarding rules and filters. A foreign rule "copy to an outside address" is a common find.
• Warn the people who already received mail from the mailbox, in your own short text, without attaching the original phish.
• Check whether the same password sits on hosting, ads and the bank. Reuse is what turns a mail into an incident.
• Do not start a general chat of shouting. One person collects the facts: who, what time, which sender address.

If the link was only opened and no password was typed, it is still worth saying so out loud. Silence "so as not to look foolish" is exactly what leaves the company a blind spot. A review that does not punish the report works better than a poster.

Lexora helps arrange that hour in advance: what counts as an incident, who to call, how not to spread the mail further. When the event is already underway, we join the response, not a search for the guilty employee.