Someone clicked the link: what to do in the first hour

The person who clicked usually knows within seconds that something was wrong, and the best thing they can do is say so immediately. What happens in the next hour decides whether this is a short, contained incident or the start of a much longer one.

First, make reporting easy

People who are afraid of blame wait, delete the email and hope. That costs the hour that matters. Thank the person who reported it, every time, and make sure staff know exactly who to tell and how. A known phone number or chat channel works better than a form.

Work out which kind of incident it is

• Credentials entered: the user typed a password, and possibly an MFA code, into a fake sign-in page.
• Something ran: the user opened an attachment, enabled macros or ran a download.
• Neither, yet: the link was opened but nothing was entered or run. Still worth checking, but lower urgency.

If a password was entered

1. Reset the password, and any other account that used the same one.
2. Sign the user out everywhere. In Microsoft 365 this is "Revoke sessions" on the user in Entra ID; Google Workspace has an equivalent. A password reset alone does not end sessions an attacker already has.
3. Check the user's MFA methods for anything newly added, such as an unfamiliar phone or authenticator, and remove it.
4. Check mailbox rules and forwarding. Attackers often add a rule that forwards or hides mail. See Microsoft 365 security settings for blocking external forwarding.
5. Check app consents. A phishing page can ask the user to grant an application access to their mailbox, which survives a password change.
6. Review sign-in logs for the account over the last few days: new locations, new devices and failed MFA attempts.

If something ran on a device

1. Disconnect the device from the network: unplug the cable, turn off Wi-Fi. If your endpoint protection can isolate it remotely, do that.
2. Do not switch it off, reinstall it or wipe it yet. Memory and logs on the device are evidence of what ran and what it reached.
3. Run a full scan with your endpoint protection, and check whether other devices show the same detection. See EDR vs antivirus for what good detection looks like.
4. Treat the user's passwords as exposed too, and follow the steps above.

In every case

• Warn colleagues. The same email has usually gone to others. Ask them not to open it, and remove copies from mailboxes if your mail system allows it.
• Block the sender and the link at the mail filter and the firewall's web filtering.
• Write everything down: times, what was seen, what was done and by whom. It is needed for the insurer, for any report, and for learning from it.
• Decide on reporting. In India, CERT-In's directions require specified cyber incidents to be reported within six hours of being noticed. Decide quickly whether this is one, and involve your insurer if you have cover. See CERT-In's log rule for the wider requirements.

After the first hour

Once it is contained, look at how the email got through and what would have stopped it: mail filtering, MFA that resists phishing, or a warning banner on external mail. If money was involved, such as a changed bank account on an invoice, see invoice fraud and contact the bank immediately.