Prepared at the Request of Counsel
Email account compromise: scope, root cause and affected parties
Business email compromise of a finance mailbox, 21 to 24 September 2026
Sample document. This is a fictional specimen prepared to illustrate the structure of an ITRS incident response deliverable. The client, users, accounts, IP addresses, hash values, events and findings are invented and do not relate to any real matter.
IT Rapid Support Inc. · 7810 Keele St, Concord, ON L4K 0B7 · (289) 582-9930
Contents
- 1Executive summary3
- 2Background and instructions4
- 3Scope and questions examined4
- 4Evidence register and chain of custody5
- 5Methodology and sources6
- 6Timeline of attacker activity7
- 7Key findings8
- 8Containment and remediation9
- 9Notification considerations10
- 10Limitations and assumptions10
- 11Examiners’ declaration11
- AAppendix A – Exhibit list11
- BAppendix B – Indicators and confidence scale11
Important notice
This report has been prepared by IT Rapid Support Inc. (“ITRS”) at the request of external counsel, for the purpose of providing legal advice to the client in connection with a security incident, and in contemplation of litigation. It is intended to be subject to solicitor-client and litigation privilege and must not be disclosed, copied or relied upon by any other party without ITRS’s written consent.
Findings are based on the evidence items listed in section 4 as they existed when collected, and are subject to the limitations in section 10. Nothing in this report is legal advice; questions of notification and liability remain with counsel.
Cloud audit sources record time in UTC. The review window is defined in UTC; events in the report are shown in Eastern Time (EDT, UTC−04:00) with the original UTC values retained in the exhibits. Individuals are referred to by role or initials.
1Executive summary
On 23 September 2026 a customer of the client telephoned to confirm a request, received by email from the client’s accounts payable lead (“User A”), to send payments to a new bank account. The client had sent no such request. External counsel retained ITRS the same morning to contain the incident and to establish how the mailbox was compromised, what was accessed and who was affected.
ITRS collected and hash-verified fourteen evidence items and examined the 72-hour window from 21 September 12:00 UTC to 24 September 12:00 UTC. Our answers to counsel’s questions are summarized below and detailed in section 7.
| No. | Question from counsel | Conclusion | Confidence |
|---|---|---|---|
Q1 | How did the attacker gain access? | An adversary-in-the-middle phishing page captured User A’s password and session token on 22 Sep at 09:21; the token was replayed from attacker infrastructure one minute later (F1). | High |
Q2 | When did unauthorized access begin and end? | Began 22 Sep 09:22 ET. Ended 23 Sep 10:52 ET when sessions were revoked; later attempts failed (F1, F2). | High |
Q3 | What information was accessed? | 1,146 mail items were read or synced. 38 contain personal information of 27 individuals; no file-share or OneDrive access (F4). | Moderate |
Q4 | Who outside the client was affected? | Three customers received payment-redirection emails. One payment of $48,600 was made and recalled in full (F5). | High |
Q5 | Were other accounts compromised, and is access removed? | No other account shows attacker sign-ins, rules or consent grants. All persistence was removed by 23 Sep 11:30 ET (F6). | High |
Containment was complete within 2 hours of ITRS’s instruction. The root cause was a phishing technique that defeats push-based multi-factor authentication; the remediation in section 8 addresses it directly.