Treat this as urgent
Common warning signs
- Password no longer works
- Unexpected MFA prompts
- Mailbox rules or forwarding changes you did not create
- Sent messages you do not recognize
- Security alerts for unusual sign-in activity
Immediate actions
- Change the password from a trusted device.
- Deny unexpected MFA requests.
- Create a ticket immediately.
- Do not delete suspicious emails or evidence unless instructed.