Step 1: A Former Employee Becomes a Contractor 

A former full-time employee returns as a part-time contractor. To make life easier, management approves the use of Microsoft 365 directly onto the contractor’s personal computer. Nobody thinks twice about this, despite it breaching the company’s informal (and rarely enforced) Bring Your Own Device (BYOD) policy. 

Step 2: Phishing Opens the Door 

The contractor clicks on a seemingly innocent email sent to their personal account that turns out to be a well-crafted phishing attack. Without MFA, the hacker quickly gains access to the contractor’s Microsoft 365 account, including sensitive internal documents, emails, and client data. 

Step 3: A Spreadsheet Full of Passwords 

Inside this compromised account, the hacker finds a spreadsheet labelled “Passwords”—ironically password-protected, but not securely encrypted. Within minutes, this simple password is cracked, giving the hacker access to accounts like Mailchimp and other internal systems. 

Step 4: Mailchimp Hijacked 

Now equipped with the company’s Mailchimp credentials, the attacker downloads the firm’s entire client list. They then use Mailchimp to send fake invoices directly to the company’s clients, complete with fraudulent bank details. Unsuspecting clients start transferring money directly into the hacker’s account. 

Step 5: Chaos and Downtime Across the Business 

As soon as clients alert the firm, panic sets in. Staff stop their regular tasks and rush to handle urgent communications, reassure clients, and attempt damage control. Productivity grinds to a halt, deadlines slip, and regular work piles up. Meanwhile, IT scrambles to lock down compromised accounts and investigate the breach. Hours become days, and soon, substantial time and resources are dedicated to responding to the incident instead of core business functions. 

Step 6: Email Reputation Damage 

Adding insult to injury, the attacker also uses compromised staff email accounts to distribute spam and further phishing attacks to the firm’s clients. Email services mark the firm’s domain as spam, causing genuine client emails to be blocked or flagged as suspicious. Critical client communications go unanswered, damaging relationships and causing significant reputational harm. 

Step 7: Personal Fallout 

Long-standing staff members often have personal details like date of birth, addresses, and bank information within their email accounts. Using this data, the hacker resets passwords and gains access to personal accounts such as PayPal, iCloud, and even bank accounts, turning a business breach into a deeply personal ordeal for employees.