When does phishing become a reportable incident?

Phishing itself isn’t always reportable, but it can become one if:

• Personal data is accessed or exfiltrated

• Financial fraud occurs

• The attacker gains access to sensitive systems

In these cases, legal and regulatory guidance may be required.

Note: This is general guidance, not legal advice.

Preventing future phishing attacks

Most successful phishing incidents exploit a combination of:

• Weak or missing MFA

• Over-privileged users

• Poor visibility into login activity

• Lack of user awareness

Key controls include:

• MFA for all users (especially admins)

• Conditional access policies

• Regular user awareness training

• Strong email filtering

• Monitoring for suspicious sign-ins and rule changes

Signs the attacker may still have access

After remediation, watch for:

• Reappearing mailbox rules

• Repeated MFA prompts

• New OAuth app permissions

• Logins from unfamiliar locations

• Unexpected password reset requests

If any appear, treat it as an active incident.

People Also Ask

What should a business do first after a phishing attack?

The first step is to understand what happened. Check whether the message was only received, whether a link was clicked, whether login details were entered, whether an attachment was opened or whether money or sensitive data was shared. Report the incident internally and contact IT support if an account or device may be compromised.

What should I do if I clicked a phishing link?

If you clicked a phishing link, do not enter any more information. Close the page, report the incident and tell your IT support team. If you entered login details, change the password immediately from a trusted device, enable multi-factor authentication and sign out of active sessions.

What should I do if I entered my password into a phishing site?

Change the password immediately, making sure the new password is strong and unique. Sign out of all active sessions, enable multi-factor authentication, check account recovery details, review sign-in activity and look for suspicious mailbox rules or forwarding settings. For a business account, an administrator should review the account.

Can a phishing attack cause a data breach?

Yes. A phishing attack can cause a data breach if personal data, customer information, employee records, financial information or sensitive business data is accessed, disclosed or stolen. Businesses should assess what information may have been exposed and whether reporting obligations apply.

Should we warn customers or suppliers after a phishing attack?

You should warn customers, suppliers or contacts if suspicious emails may have been sent from a compromised account, or if their information may be at risk. The message should be clear, factual and explain what action they should take, such as ignoring suspicious emails or not clicking links.

How can businesses prevent phishing attacks?

Businesses can reduce phishing risk with email filtering, multi-factor authentication, user awareness training, secure password policies, Microsoft 365 security configuration, monitoring, phishing simulations and clear reporting processes for suspicious messages.

Can IT Desk help after a phishing attack?

Yes. IT Desk can help businesses respond to phishing incidents by reviewing account access, checking Microsoft 365 sign-ins, removing suspicious forwarding rules, improving MFA, strengthening email security and supporting users after a suspected compromise.