We've been hacked. What do we do?
4 hours of cybersecurity training for 50 people — and something really changed.
It was 9:14 and it seemed like a quiet day
It's not a call you forget. The voice was tense, almost breathless. “Giacomo, we've been hacked. They've taken the email password and they're writing to our suppliers asking for payments to a foreign account.”
A second of silence. Then you switch into operational mode.
“Every minute that passes, someone could transfer money to the wrong account.”
This is exactly the kind of attack that frightens SMEs the most: no ransomware, no visible virus. Just a compromised email account, used to deceive the people who trust you.
The response
Damage first, then causes.
The first rule in an IT emergency: stop the bleeding. We acted in sequence, without wasting time.
🔐 Immediate password change
All the accounts involved, with strong, unique passwords generated on the spot.
📱 MFA enabled on all accounts
Two-factor authentication enabled on email, Microsoft 365 and all critical services. From then on, the password alone is no longer enough.
📞 Suppliers warned
Contacted directly to stop any transfers in progress and check whether anyone had already received the false instructions.
🔍 Analysis of active sessions
All open sessions on the compromised account checked and revoked, including access from suspicious foreign IPs.
In less than two hours the situation was under control. No supplier had made any payments yet. Financial damage: zero. Reputational damage: limited, thanks to the speed.
The aftermath
The real turning point wasn't the attack. It was the reaction.
Many companies go through an incident like this, breathe a sigh of relief and go back to their old habits. Not this client.
That panicked phone call became a different conversation. “I never want this to happen again. What do we need to do?”
Together we built a structured plan:
From emergency to prevention
Monthly proactive monitoring contract – no more hours on call, but continuous oversight
Cybersecurity course for the whole team – phishing, social engineering, password hygiene
Full inventory of IT assets and active SaaS services
Updated GDPR policy with a record of processing activities and DPAs with suppliers
Mandatory MFA on all services, no exceptions
Today this client sleeps more soundly. Not because they're immune to attacks – nobody is – but because they know someone is monitoring, responding and acting before it becomes an emergency.
Cybersecurity is not a product. It's an ongoing process. And it often starts with a bad experience.
Don't wait for the wrong phone call.
Let's talk about how to secure your business before someone else does it for you.
