Our email was hacked and they told us an incident investigation is a must: Who does this and what gets logged?

By restarting the server, you probably already wiped the live network sockets and volatile attacker sessions from RAM. Panic moves like this from sysadmins usually destroy the exact evidence forensic analysts need most. Don't install or delete anything else on the system from here on out; just take a direct disk image right away.

Definitely check the mailbox forwarding rules. Attackers usually create stealth rules that forward any emails containing words like invoice, payment, receipt to an external address, or move incoming replies straight into the deleted items folder. Also archive the admin audit logs from your mail management console immediately.

What you need to do right now: run a sign-out of all sessions from the email admin console and enforce two-factor authentication for every single employee without exception. Even if the password was changed, unexpired session tokens can keep the attacker logged in.

We went through this exact same invoice-swapping scheme last year at our logistics office in Moscow. We paid a local cybersecurity firm 450,000 RUB for the incident investigation. The analysis revealed that the attacker had gotten in through a phishing email on the accountant's machine and was silently monitoring our threads for 43 days.

seriously incredible luck that the bank caught it at the last second, 3.8 million rubles is no small change. but the consultant is right they couldve easily breached another machine on the network besides that mailbox. honestly dont sleep on the investigation imo.

Under Russian Federation legislation, you have statutory obligations regarding the protection of personal data and trade secrets. If the fallout extends beyond company walls and you plan to file a criminal complaint with law enforcement, a licensed expert report proving the chain of custody remained intact will be your only valid standing in court.

Invoice fraud like this isn't carried out randomly. The attacker had already mapped out your accounting workflow, your tone with the supplier, and your billing schedules. That means they've been lurking and observing for days or even weeks. Your internal team can only put out the visible fire; you definitely need an experienced external pair of eyes for root cause analysis.

Im a small business, let me explain from my side... tbh if permission and scope arent in writing dont start that test.

Good luck with that.

Noted, thanks.

Let me share what happened to me; it might be useful. When you try to change everything at once, nothing settles.

This is my opinion, I'm not claiming it's absolute truth.

There's one point I'm curious about. Hasty decisions become decisions you have to fix six months later.

If I were you, I'd go this route.

We need to make a distinction here. Taking measures without an inventory leaves doors you haven't seen open.

Taking measures without an inventory leaves doors you haven't seen open.

I think it's hard to be that definitive about incident investigation. Taking measures without an inventory leaves doors you haven't seen open.

Just leaving this note, it might be useful.

Thanks, that was the answer I was looking for. Mistakes made on the incident investigation side are usually reversible but expensive.

If I were you, I'd go this route.

Quick summary for newcomers: Your time to detect an issue directly determines its cost.

Correct me if I'm wrong.

Could you elaborate on that? If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Most time waste accumulates in tasks waiting for approval. Correct me if I'm wrong.

Let me share what happened to me; it might be useful. Having backups accessible on the same network and with the same identity makes them part of the target.

Proven by experience.

Generally correct, but one part is missing. anyway everyone rushing into incident investigation gets stuck at the same point.