Home › Services › Compromised Account Cleanup

Compromised Account Cleanup

If someone got into a mailbox, Greg contains it, removes what the attacker left behind, checks the rest of your tenant and writes it up.

Have cyber insurance? Call your carrier first. This is not insurer forensics. If your carrier assigns its own team, Greg will pause and work with them.

Price

• $1,500 for the first mailbox (non-admin, 30-day lookback) — $1,200 for active Monthly Security Watch or Monthly Admin clients
• $350 for each additional mailbox
• $175/hour for admin-account, multi-account or urgent same-evening response (quoted in writing)

What’s included

• Password reset and every active session signed out
• Attacker inbox rules, forwarding, delegates and app consents removed
• Rogue MFA methods removed and MFA re-registered
• Sign-in history reviewed and the rest of the tenant checked for the same signs
• A written incident summary and a template to warn your customers

What’s not included

• Legal or breach-notification advice
• Recovering money sent by wire (call your bank right away)

Related: how to tell if business email was hacked · what to do first.

This is not a help desk: printers, desk phones and slow computers stay with whoever handles them today. Reports do not guarantee insurer approval or certify any compliance program. Follow-on work covers only the numbered fixes in your signed scope; anything beyond that list is quoted separately. All services · Sample report · How remote service works · FAQ