Flare · Account compromise

Someone else has been in your account.

A compromised email or cloud account is often the start of something bigger: payment fraud, a data breach or access to other systems. Resetting the password is necessary, but it doesn't tell you what the attacker did while they were in.

We answer the questions that matter afterwards. How did they get in? What did they see or take? Are they really gone?

Call 1300 027 401 (24/7) Send an enquiry

Common signs

→Sign-ins from unfamiliar locations or devices.
→MFA prompts nobody requested.
→Sent emails nobody remembers writing, or replies to emails never sent.
→New inbox rules, forwarding addresses or connected apps.
→Files shared externally without explanation.

Do these now

01

Reset and sign out

Change the password and sign out all active sessions. Make sure multi-factor authentication is on.
02

Check for forwarding

Look for, but don't delete, forwarding rules or connected apps. Note what you find and call us.
03

Keep the evidence

Don't delete suspicious emails or rules. They show what the attacker did.
04

Tell your contacts if needed

If emails were sent from the account, warn recipients by phone not to act on payment requests.

What Flare does

How we help

Trace the access

We review sign-in and audit records to establish when and how the account was accessed.

Map what they touched

We identify emails read, files opened or downloaded, rules created and messages sent.

Confirm they're out

We check for persistence, such as connected apps, tokens and other compromised accounts, with your IT team.

Report what was exposed

We report what personal information was exposed, so you and your lawyer can assess notification obligations.

You'll know how far it went, whether it's over, and what to tell your clients, insurer and regulator.

Having a cyber incident?

Call now. The line is answered 24/7, and early action protects evidence and money.

Call 1300 027 401 First-hour checklist

Common questions

How far back can you see?

That depends on the platform, the licence level and the settings in place. Some records are kept for a limited time, so it pays to start quickly.

Do we need a forensic investigation for one hacked mailbox?

Not always. If no money moved and no sensitive information was in the account, a quick review may be enough. We'll tell you honestly on the first call.

Testimonials

Trusted when it matters

"Mark and the team have been invaluable to me and my businesses. Their responsiveness is second to none, and their "bedside manner" is unparalleled. In the moments you need Sicarius the most, Mark and his team know you need experts that care and that is why I trust them implicitly."

Joni Pirovich

CEO · Crystal aOS

Business email compromise →Ransomware → Read: Five signs your business email account has been compromised → All Flare services →