After the Breach: What Happens When Someone Gets In

A Microsoft 365 Identity Compromise — Investigated, Contained, and Documented A GDS Technology Case Study | Incident Response Industry: Commercial Real Estate | Services: IR Investigation, Forensic Analysis, Remediation

The Phone Call No One Wants to Make

The email didn't look suspicious at first. It looked like every other thing that lands in an inbox on a Tuesday morning. But someone clicked — and three seconds later, the attacker was in.

A professional services organization with a multi-state footprint contacted GDS Technology after a staff member reported unusual activity in their Microsoft 365 account. Emails were being sent that the user didn't write. Inbox rules had been created that the user didn't set up. The signals were clear: a Microsoft 365 account had been compromised.

GDS opened an incident ticket and began a full forensic investigation the same day.

What Happened

The attack was a session token theft — one of the most effective and increasingly common methods for bypassing multi-factor authentication. The attacker used a phishing email to redirect the user to a convincing fake login page. When the user authenticated, the attacker captured not just the password, but the active session token — effectively stealing the authenticated session without needing to know the MFA code.

From there, the attacker moved quickly:

• Established persistence in the Microsoft 365 tenant using the captured session

• Created inbox rules to redirect or delete incoming mail — including replies to any messages the attacker sent

• Accessed mailbox content and conducted reconnaissance on email history

• Used the compromised account to send emails to external parties

The Investigation

GDS's investigation covered the full scope of available Microsoft 365 telemetry: sign-in activity logs, interactive and non-interactive authentication records, mailbox audit logs, inbox rule analysis, phishing email forensics (including sandbox analysis), Blackpoint MDR alerts, endpoint review, and Entra device examination.

The investigation uncovered a critical issue beyond the incident itself: the licensing in place at the time of the attack did not include the advanced audit capabilities needed to reconstruct a complete historical record of file access during the compromise window. This is a common gap — and one that has direct consequences when organizations need to evaluate breach notification obligations under multi-state privacy law.

GDS documented every confirmed finding, every reasonable investigative conclusion, and every limitation in available telemetry. The report was structured to be reviewable by both executives and legal counsel — written clearly enough for ownership to understand and technically precise enough to support a legal proceeding if needed.

25+	Multiple	Same Day	100%
Report sections covering every phase of the incident	States with potential breach notification exposure	Investigation opened after client notification	Attacker access terminated before report delivery

What Was Found — And What It Meant

The investigation confirmed unauthorized access to the email account and mailbox. The scope of data exposure during the active compromise window could not be fully reconstructed due to the licensing limitations — which is precisely the kind of finding that matters to a cyber insurer, outside counsel, or a state attorney general.

GDS's report identified the security controls that were present at the time of the incident, the controls that were absent, and the specific licensing and configuration gaps that allowed the attack to succeed and limited the investigation's reconstruction capability.

The environment lacked:

• Defender for Office 365 Plan 2 (required for Safe Links click telemetry and complete phishing forensics)

• Entra ID P2 risk-based identity protection (would have flagged the anomalous token use in real time)

• Purview Advanced Audit (required for full file-access reconstruction during the compromise window)

• Phishing-resistant MFA (passkeys or certificate-based authentication that prevents token theft attacks entirely)

• Mature Conditional Access policies (would have detected and blocked the unfamiliar session)

The Remediation Path

GDS did not just investigate and walk away. The incident response report included a complete corrective action framework and a forward-looking licensing recommendation designed to eliminate the conditions that allowed this attack to succeed.

The recommended path was Microsoft 365 E5 — the only single-SKU solution that addresses all three failure points identified in the investigation: email security, identity protection, and audit visibility. The alternative — patching gaps individually with add-on subscriptions — was evaluated and documented, but E5 was recommended as the most defensible and cost-effective long-term solution given the client's multi-state regulatory exposure.

GDS also produced a breach notification analysis covering the client's multi-state regulatory footprint, mapping which states had triggered notification windows, what the obligations were, and what the cost-of-inaction looked like if the licensing gap was not corrected before a future incident.

The Lesson

Session token theft defeats MFA. It is not a brute-force attack and it is not stopped by a strong password. The only defenses that work are phishing-resistant authentication methods, conditional access policies that evaluate the risk posture of every sign-in, and advanced email filtering that intercepts the initial phishing delivery before the user ever sees it.

Every one of those defenses was available to this organization. None of them were in place.

GDS's role in an incident like this is not just to stop the bleeding — it is to make sure the organization understands exactly what happened, what it exposed, what it cost in investigative limitation, and what it will take to make sure it doesn't happen again.

"The investigation told us what happened. The report told ownership what it meant. The remediation plan told them what to do next. That's the full picture — and it's what every organization deserves when something goes wrong."

— Jonathan Fitzgerald, Managing Partner, GDS Technology

Is Your Organization Ready for a Breach?

Most Microsoft 365 environments have licensing and configuration gaps that prevent complete forensic reconstruction after an incident. Most organizations don't discover those gaps until they need the data — and it isn't there.

GDS Technology conducts proactive Microsoft 365 security assessments that identify your gaps before an attacker does. If an incident has already occurred, GDS provides full incident response investigation, containment, and a deliverable-grade report that can stand up to legal and regulatory scrutiny.

Industry	Commercial Real Estate / Professional Services
Client Type	Multi-state organization with regulatory exposure across multiple jurisdictions
Services	Incident Response, Forensic Investigation, Breach Notification Analysis, Licensing Strategy
Attack Type	Session token theft / MFA bypass phishing
Outcome	Attacker evicted; full IR report delivered; E5 upgrade path documented

A breach isn't just an IT problem — it's a legal and business event. GDS Technology investigates, remediates, and documents. gdstech.tech | 404-719-5222