a phishing email spread across the company, 30 people clicked the link — what to do?

clicking on phishinng links is normal about 100 people fall for this stuff every week. what matters is what you do now. if a download happened (malware installed) that's the concern.

30 people gave credentials but which ones gave passwords or 2FA codes? which ones just 'clicked' without providing info?

examine the mail headers, find the IP of the fake mail server. check antivirus logs to see if any malware was detected.

Edit: asked below, I wrote the answer in the second message.

Urgent: Force password reset for 30 users (via email channel, force an antivirus product), enable MFA for the entire company, add the phishing email address to the spam list. Complete within 1 day.

notify the client, no harm done. you've been victimized the client will hear about it from elsewhere anyway. if you report 'we've got it under control', your image stays better.

I have no experience with phishing attack, so I'm asking. Everything goes well for the first three months; problems arise in the fourth.

Taking measures without an inventory leaves doors you haven't seen open. Hope this helps.

You're right.

Following. Forgotten test environments are more often the entry point than live systems.

I'd appreciate it if you shared the outcome. Most time waste accumulates in tasks waiting for approval.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. If you post the result here, it will help others too.

Following.

I didn't know that. If permission and scope aren't in writing, don't start that test.

Good luck with that.

Correct.

I was thinking the same thing. Trying to do this alone is the most expensive way.

Just leaving this note, it might be useful.

My perspective changed after experiencing that. The answer varies greatly by industry; there is no one-size-fits-all rule.

I'm also curious if anyone does it differently.

let me share my experience but btw if you scold false alarms, nobody will report again.

payment information changes are never verified through the channel they came from then if I were you, I'd go this route.

Saved.

If I understood correctly, you're saying: Mistakes made on the phishing attack side are usually reversible but expensive.

Good luck with that.

we need to make a distinction here. the biggest time-waster for us was not knowing who had the final say.

the biggest time-waster for us was not knowing who had the final say. this is my opinion I'm not claiming it's absolute truth.