What should cyber incident response cover when employee credentials are compromised?

When employee credentials are compromised, cyber incident response should treat the identity as a potential route into every service, device and dataset that it can access. The response must therefore establish the credential’s scope, determine what the user or attacker could do, preserve reliable records of activity, and return the affected identity to a trusted state without disrupting essential business processes unnecessarily.

Establish the facts about the credential. Identify the account type, user, associated roles, authentication methods, linked devices, privileged permissions and connected applications. The same username may provide access to email, file storage, finance systems, customer platforms, collaboration tools or remote administration services. Personal accounts used for business purposes should also be considered if company information may have been exposed through them.

• Record when the compromise was discovered and how it was detected.
• Determine whether the exposed secret was a password, access token, recovery code, session cookie or application credential.
• Check whether the same or a similar secret was used for other services.
• Identify delegated access, shared mailboxes, service accounts and administrator relationships connected to the user.
• Separate confirmed facts from assumptions, and record the source of each finding.

Assess the account’s effective privileges. A compromised standard user account may still expose sensitive information or provide access to systems that can be used to reach higher-value assets. Review group membership, role assignments, administrative elevation, file permissions and access granted through third-party applications. Particular attention is needed where the user can approve payments, change supplier details, export customer records, manage devices or create additional accounts.

Examine identity and email activity. Authentication records can show where the account was used, which applications were accessed, whether sign-in patterns changed and whether authentication challenges were approved unexpectedly. Email should be assessed for forwarding rules, inbox rules, deleted messages, sent items, mailbox delegation and changes to signatures or recovery information. An attacker may use an account for fraud or further compromise even when there is no clear evidence that messages were downloaded.

Investigation should also cover consent and application activity. Unfamiliar OAuth grants, browser sessions, API keys, persistent tokens and synchronised devices may allow continued access after the original password is changed. These authorisations need to be reviewed according to their purpose and removed where they cannot be verified as legitimate. A password change alone does not necessarily invalidate every form of access associated with an account.

Determine what information may have been exposed. The assessment should distinguish between an account being accessed and particular data being viewed, copied, altered or deleted. Review audit records from relevant services, including downloads, searches, exports, sharing changes and bulk activity. Consider both the sensitivity of the information and the people or organisations it relates to, such as employees, customers, suppliers and business partners.

• Classify potentially exposed information, including personal data, financial information, intellectual property and commercially confidential material.
• Identify records that may have been changed rather than only those that may have been read.
• Check whether data was shared externally, synchronised to an unmanaged device or sent through email.
• Compare activity with the employee’s normal duties and established working patterns.
• Preserve relevant logs before retention periods or automated processes remove them.

Look for follow-on activity. Credential misuse can be part of a wider intrusion rather than an isolated account event. Review signs of mailbox abuse, unusual file access, new account creation, privilege changes, suspicious remote connections, malicious scheduled tasks and activity from other identities. Devices used by the employee may need examination for infostealers, browser credential theft, malicious extensions or other causes of the exposure. The investigation should follow the evidence rather than assume that the first affected account was the original entry point.

Keep the user and business process in view. The employee should receive clear instructions about preserving relevant information and avoiding actions that could overwrite evidence. At the same time, the organisation should provide a controlled alternative if the user performs critical operational duties. Shared or generic accounts require particular care because activity may not map reliably to one individual; their ownership, use and access history should be documented as part of the investigation.

Coordinate decisions and reporting. A compromised credential can create obligations under data protection, contractual, regulatory or sector-specific requirements. The organisation should involve its data protection lead, legal advisers, insurers and relevant customers or partners where appropriate. Decisions about notification should be based on the nature of the information, the likelihood of harm, the evidence available and the applicable reporting requirements. Communications should be accurate, consistent and limited to information that has been verified.

Validate the return to normal operation. Recovery is complete only when the organisation has confidence that unauthorised access has ended and legitimate access works as intended. Confirm that permissions are appropriate, approved applications remain connected, suspicious rules and authorisations are absent, and important transactions or records have not been manipulated. Increased monitoring of the affected identity and related systems can help identify residual misuse while the incident is being closed.

Finally, document the timeline, decisions, evidence, affected resources, notifications and outstanding risks. A post-incident review should address why the credential was exposed, whether staff recognised the warning signs, which controls detected the activity, and whether identity permissions are broader than necessary. The resulting actions may include improving phishing-resistant authentication, reducing standing privilege, tightening application consent, strengthening logging and reviewing how leavers, contractors and third-party access are managed.